4.9.4 — Encryption: symmetric, asymmetric, TLS, HTTPS, digital certificates
Symmetric Encryption
Symmetric Encryption
Symmetric encryption uses the same key to both encrypt and decrypt data. Both parties must share the secret key securely.
Fast — efficient for encrypting large amounts of data
Examples: AES (Advanced Encryption Standard), DES (older, now insecure)
Problem: key distribution — how do you securely share the key with the other party in the first place?
Used for: bulk data encryption (e.g. encrypting files, databases, disk encryption)
Asymmetric Encryption
Asymmetric Encryption
Asymmetric encryption uses a key pair: a public key (shared openly) and a private key (kept secret). Data encrypted with the public key can only be decrypted with the private key.
Solves the key distribution problem — public key can be shared with anyone
Much slower than symmetric — not suitable for bulk data
Examples: RSA, ECC (Elliptic Curve Cryptography)
Used for: securely exchanging symmetric keys, digital signatures, SSL/TLS handshake
Combining Both
Hybrid Encryption
In practice, asymmetric encryption is used to securely exchange a symmetric session key. The session key then encrypts the actual data — combining the strengths of both.
Step 1: Asymmetric — client encrypts session key with server's public key
Step 2: Server decrypts session key with its private key
Step 3: Symmetric — both parties use shared session key for all subsequent data
TLS Handshake
TLS Handshake
1. ClientHello — client sends supported TLS versions, cipher suites, random number
2. ServerHello — server chooses cipher suite, sends its digital certificate (contains public key)
3. Certificate verification — client checks certificate is signed by trusted CA and not expired
4. Key exchange — client generates pre-master secret, encrypts with server's public key, sends to server
5. Session key derived — both derive same symmetric session key; encrypted communication begins
HTTPS
HTTPS
HTTPS = HTTP + TLS. Web traffic is encrypted using TLS, ensuring confidentiality, integrity, and authentication.
Browser shows padlock icon and https:// — confirms TLS is active
Confidentiality — data encrypted; eavesdroppers cannot read it
Integrity — TLS MAC ensures data has not been tampered with in transit
Authentication — certificate proves the server is who it claims to be (not an impersonator)
HTTPS operates on port 443; HTTP on port 80
Digital Certificates
SSL/TLS Digital Certificates
A digital certificate is issued by a Certificate Authority (CA) and binds a public key to a domain name. It proves the server is authentic and provides its public key for the TLS handshake.
Contains: domain name, public key, CA's digital signature, expiry date
Browser validates: is it signed by a trusted CA? Has it expired? Does the domain match?
Certificate Revocation List (CRL) / OCSP — checks if a certificate has been revoked before its expiry
Sym vs Asym Summary
Symmetric vs Asymmetric — Quick Comparison
Feature
Symmetric
Asymmetric
Keys
One shared key
Public + private key pair
Speed
Fast
Slow
Key distribution
Problem (must share key)
Solved (public key is public)
Example
AES
RSA
AQA Exam Style
Practice Question
AQA 7517 — Paper 2 Style
(a) Explain the difference between symmetric and asymmetric encryption. [3] (b) Describe how TLS ensures a web connection is secure. Include reference to both asymmetric and symmetric encryption. [4] (c) State TWO pieces of information found in a digital certificate. [2]
[9 marks]
3 marks
(a) Symmetric uses one shared key for both encryption and decryption [1]; asymmetric uses a key pair — public key to encrypt, private key to decrypt [1]; symmetric is faster but has the key distribution problem; asymmetric solves this but is slower [1]
4 marks
(b) TLS handshake: server sends its digital certificate containing its public key [1]; client verifies the certificate with the CA [1]; client uses asymmetric encryption (server's public key) to securely exchange a session key [1]; all subsequent data is encrypted with symmetric encryption using the session key (fast) [1]
2 marks
(c) Any 2: domain name / server's public key / CA's digital signature / expiry date / certificate serial number
Summary
Key Points to Remember
Symmetric — one key, fast, key distribution problem; example: AES