Symmetric encryption
Uses a single shared (private) key to both encrypt and decrypt data. It’s fast and efficient for large amounts of data, but both parties need a secure way to share that key beforehand. If the key is intercepted, the encryption is broken. Examples: AES, DES.
Asymmetric encryption (public/private keys)
Uses a mathematically linked key pair: a public key (shared) and a private key (secret). Data encrypted with the public key can only be decrypted with the matching private key. This removes the need to share a secret key in advance, but it’s computationally slower than symmetric encryption. Examples: RSA, ECC.
Note: The RSA encryption algorithm allows data encrypted with the private key to be decrypted using the public key – this is not to hide the data (because everyone can access the public key) but to authenticate the data (see below)
Certificate purpose and use
A digital certificate binds a public key to an identity (a person, server, or organisation), issued and signed by a trusted Certificate Authority (CA). It lets a user or system (browser, operating system) verify that a public key genuinely belongs to who it claims to, preventing impersonation. Web browsers use certificates to confirm they’re connecting to the real website, not an imposter (this underpins HTTPS).
Use of asymmetric encryption to prevent unauthorised access to data
The sender encrypts data using the recipient’s public key. Only the recipient’s private key can decrypt it, so even if the data is intercepted in transit, an attacker without the private key can’t read it.
Use of asymmetric encryption to authenticate data (digital signatures)
The sender encrypts (signs) data (often a hash of it) using their own private key. Anyone can verify it using the sender’s public key. If it decrypts successfully, this proves the data came from that sender (authenticity) and hasn’t been altered (integrity), since only they hold the private key.
Secure communication over the internet
Combines both encryption types to get security and speed: this is the basis of protocols like TLS (used in HTTPS).
Note on TLS (Transport Layer Security)
TLS is the protocol that actually implements the “secure communication over the internet” process described earlier. It’s the security layer behind HTTPS (the padlock icon in your browser), and also secures things like email and VPNs.
How it works:
- Connection request – The client (e.g. your browser) contacts the server and requests a secure connection.
- Certificate exchange – The server sends its digital certificate, containing its public key, signed by a trusted Certificate Authority. The client verifies this certificate (your browswer/system contains all common CA certificates) to confirm it’s really talking to the genuine server (not an impersonator).
- Key exchange (asymmetric encryption) – Using asymmetric encryption, the client and server securely agree on a shared session key.
- Switch to symmetric encryption – Once the session key is established, all further data (the actual webpage content, credit card details, etc.) is encrypted using symmetric encryption with that session key, since it’s much faster for bulk data transfer.
Why TLS matters:
- Confidentiality – data can’t be read if intercepted.
- Integrity – data can’t be tampered with undetected in transit.
- Authentication – confirms you’re communicating with the genuine server, not an attacker.
Note: TLS replaced the older SSL (Secure Sockets Layer) protocol, which is now considered outdated and insecure – people still often say “SSL” out of habit when they actually mean TLS.
Note on hashing
A hash function takes an input (a file, a password, a message) and produces a fixed-length string of characters called a hash. It’s a one-way process: you can easily generate a hash from data, but you cannot reverse the hash back into the original data.
Key properties
- One-way – computationally infeasible to work backwards from the hash to the original input.
- Deterministic – the same input always produces the same hash.
- Fixed length – regardless of input size, the output is always the same length (e.g. SHA-256 always produces 256 bits).
- Avalanche effect – even a tiny change to the input (one character) produces a completely different hash.
- Collision-resistant – it should be extremely unlikely for two different inputs to produce the same hash.