The core difference
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared secret key | A public + private key pair |
| Speed | Fast — good for bulk data | Slow — good for small data/key exchange |
| Algorithms | AES, ChaCha20, 3DES (legacy) | RSA, ECC, Diffie-Hellman, DSA |
| Main challenge | Securely distributing the shared key | Computationally heavy |
What asymmetric keys do
- Confidentiality: encrypt with the recipient's public key → only their private key decrypts.
- Authenticity / signatures: sign with your private key → anyone verifies with your public key.
- Key exchange: Diffie-Hellman lets two parties derive a shared secret over an open channel.
The hybrid model (how TLS works)
The pattern
TLS uses asymmetric crypto to authenticate the server and exchange a symmetric session key, then uses that fast symmetric key for the bulk of the data. Best of both: secure key exchange + fast encryption.
Where hashing fits
Hashing (SHA-256, SHA-3) is one-way — it produces a fixed-length digest and cannot be reversed. It verifies integrity, not confidentiality. Don't call it encryption.
- Encryption is reversible (with the key).
- Hashing is not — used for integrity checks and password storage (with salt).
Exam traps
- Calling hashing encryption. Hashing is one-way and keyless.
- Using asymmetric for bulk data. It's too slow; use it to exchange a symmetric key.
- 3DES/DES as "secure". Both are deprecated; use AES.
Test yourself
4 quick questions — tap an answer to check it instantly. Nothing is sent anywhere.
1. Which uses a single shared key?
Answer: C. AES is symmetric — one shared secret key. RSA/ECC/DH are asymmetric.
2. To send a confidential message, you encrypt with the recipient's…
Answer: B. Encrypt with the recipient's public key; only their private key decrypts.
3. A digital signature is created with the sender's…
Answer: B. You sign with your private key; others verify with your public key.
4. Which is one-way and cannot be reversed?
Answer: C. Hashing is one-way; it is not encryption.
Sources
- CompTIA Network+ / Security+ exam objectives.
- Relevant RFCs and vendor documentation.
Reference summary only. Algorithm choices should follow current NIST guidance.