How does the key get there?#
You want to send a file to somebody across the internet, encrypted. You have a fast cipher and a strong key.
How do you get the key to them? You cannot meet, and anything you send can be read in transit. Think it through before reading on.
The usual first answer is “send the key first, then the file.” But whoever is reading your traffic reads the key too, and then reads the file. Encrypting the key needs another key, which has the same problem.
That is the key distribution problem, and it is the reason two kinds of encryption exist. Symmetric is fast but assumes you already share a secret. Asymmetric is slow but lets two strangers agree on one in the open.
Real systems use both: asymmetric to agree on a key, symmetric to move the actual data. Knowing why is most of what gets examined.
The short answer#
Symmetric encryption uses one shared secret key for both encryption and decryption. It's fast, but both sides need the same key. Asymmetric encryption uses a pair of keys (a public key and a private key). It's slow, but it solves the problem of safely sharing keys and enables digital signatures.
Symmetric encryption#
The same key locks and unlocks the data. Because the math is simple, it's very fast and ideal for encrypting large amounts of data (files, disks, network traffic).
- Keys: one shared secret.
- Examples: AES, ChaCha20, (older) 3DES.
- The catch: key distribution: how do you get the shared key to the other side securely without an attacker intercepting it?
Asymmetric encryption#
Each party has a mathematically linked public/private key pair. Anything encrypted with the public key can only be decrypted with the matching private key (and vice versa for signatures). The public key can be shared openly; the private key is kept secret.
- Keys: a public key + a private key.
- Examples: RSA, ECC (elliptic curve), Diffie-Hellman (key exchange).
- Superpowers: it solves key exchange (no need to pre-share a secret) and enables digital signatures and non-repudiation.
- The catch: it's much slower, so it's impractical for bulk data.
Side by side#
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared secret | Public + private pair |
| Speed | Fast | Slow |
| Best for | Bulk data (files, disks, traffic) | Key exchange & digital signatures |
| Examples | AES, ChaCha20 | RSA, ECC, Diffie-Hellman |
| Main challenge | Distributing the shared key | Performance |
Why TLS (HTTPS) uses both#
This is the classic exam scenario. TLS is a hybrid: it uses asymmetric encryption at the start to safely exchange a shared symmetric session key, then switches to fast symmetric encryption for the actual web traffic. You get asymmetric's safe key exchange and symmetric's speed.
If a question asks what encrypts large amounts of data quickly → symmetric (AES). If it asks how two parties exchange a key over an untrusted network or how to sign something → asymmetric. If it describes needing both speed and safe key exchange (like TLS) → the hybrid approach.
Test yourself in the free Kestrel Exams app
Topic-selectable practice — offline, no ads, no account.
Practice this topic →Frequently asked questions#
Which is faster, symmetric or asymmetric?
Symmetric is far faster and is used for bulk data. Asymmetric is much slower and is used mainly for key exchange and digital signatures.
Which type encrypts large amounts of data?
Symmetric encryption (for example AES). Asymmetric is too slow for large volumes.
Why does TLS use both?
TLS uses asymmetric encryption to exchange a shared symmetric session key, then uses fast symmetric encryption for the actual data, combining safe key exchange with speed.
How many keys does each use?
Symmetric uses one shared secret key. Asymmetric uses a matched public/private key pair.
Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written — several of these exist because somebody asked.