Encryption in Depth
CIE candidates must distinguish symmetric from asymmetric encryption, explain the key-distribution problem and walk through a full asymmetric exchange. OCR, AQA and Edexcel only require encryption as a high-level concept.
When you visit a website starting with https://, your browser and the server have to agree on a secret key without ever speaking before. They have never met, anyone could be listening, and yet within milliseconds they share a secret no eavesdropper can read. The trick that makes that possible is asymmetric encryption.
Symmetric encryption
Both sides share one key. The sender uses it to encrypt; the receiver uses the same key to decrypt.
Plaintext ----[ encrypt with KEY ]----> Ciphertext Ciphertext ----[ decrypt with KEY ]----> Plaintext
Strength: very fast.
Weakness: how do the two sides agree on KEY in the first place without an eavesdropper seeing it? This is the key-distribution problem.
Asymmetric encryption
Each user has two mathematically linked keys.
Alice wants to send a private message to Bob. 1. Bob shares his PUBLIC key with the world. 2. Alice encrypts her message with Bob's PUBLIC key. 3. The ciphertext travels across the internet. 4. Only Bob's PRIVATE key can decrypt it. An eavesdropper who copies both the public key and the ciphertext still cannot read the message.
Public keys can be shared openly because they cannot decrypt anything. There is nothing for an eavesdropper to steal.
Comparing the two
Real systems like HTTPS use asymmetric encryption to agree on a symmetric key, then switch to symmetric for speed.
Beyond the basics
Symmetric only: very fast, but how does your browser and the server agree on the secret key without a previous conversation? An eavesdropper would copy the key as it travelled and then read everything. This is the key-distribution problem.
Why combine them: asymmetric is used briefly at the start of the connection to safely exchange a fresh symmetric key. Once that key is in place, both sides switch to symmetric for speed. You get safe key distribution and fast bulk encryption together.
Symmetric vs asymmetric, side by side
| Feature | Symmetric | Asymmetric |
|---|---|---|
| Number of keys | One shared key | Two: a public and a private key |
| Speed | Fast (cheap to compute) | Slow (expensive maths) |
| Key distribution | The hard problem - both sides need the same secret without anyone else seeing it | The public key can be shared freely; only the private key is secret |
| Best used for | Bulk data after a secure connection is established | Initial key exchange and digital signatures |
| Real example | AES inside a HTTPS session | RSA used to set up a HTTPS session |
A real HTTPS session uses asymmetric encryption only at the start to share a fresh symmetric key safely. Everything after that is symmetric, because symmetric encryption is much faster. This is called a "hybrid" cryptosystem and is the answer to many CIE 6-mark questions.
Both can be equally strong if the key length is large enough. The real difference is convenience: asymmetric solves the key-distribution problem, but at a cost in speed. Once a secure channel exists, symmetric is preferred for bulk data because it is much faster, not less safe.
A six-mark exam question with mark scheme
Question (CIE-style, 6 marks): A bank uses asymmetric encryption to start a secure connection with a customer's browser, then switches to symmetric encryption for the rest of the session. Explain why this hybrid approach is used.
- Asymmetric encryption uses two keys, one public and one private.
- The bank publishes its public key so anyone can encrypt a message that only the bank can decrypt.
- This solves the key-distribution problem because no shared secret needs to be exchanged in advance.
- Asymmetric encryption is computationally slow, so using it for every byte would make the connection feel sluggish.
- Symmetric encryption uses one shared key and is much faster.
- The customer's browser uses the asymmetric key to send a fresh symmetric key to the bank securely.
- From that point on, both sides use the fast symmetric key to encrypt the rest of the conversation.
Beyond the basics
1. Speed. Symmetric encryption (AES) is hundreds of times faster than asymmetric (RSA). Encrypting a video call asymmetrically would melt the laptop.
2. Practical use today. Every HTTPS connection in the world uses symmetric encryption for the bulk of the data, not just the handshake. So far from obsolete, it is doing the heavy lifting on the modern internet.
When to choose symmetric deliberately: any situation where the two sides already share a secret, e.g. a school's intranet using a pre-shared key on staff laptops, or two servers in the same datacentre that have been configured with a shared key by the system administrator. There is no key-distribution problem to solve, so the slow asymmetric step is wasted.