Encryption
When data is transmitted over a network (such as the internet), it travels through multiple physical devices and cables. Without encryption, anyone who intercepts this data can read it. Encryption ensures that even if the data is intercepted by an unauthorized person (an eavesdropper), they cannot understand its content without the correct decryption key.
Building on the concept of data security, encryption does not prevent the data from being stolen or intercepted; it only prevents the data from being understood if it is intercepted.
Cipher text: The scrambled, unreadable output produced after the plain text has been processed by an encryption algorithm using a key.
The goal of encryption is to transform plain text into cipher text. The goal of decryption is to transform cipher text back into plain text.
- The sender uses a specific encryption key to convert plain text into cipher text.
- This same key is sent securely to the receiver.
- The receiver uses this identical key to decrypt the cipher text back into plain text.
Because the same key is used, both parties must already possess or securely share this secret key before communication begins.
- The public key is shared openly with anyone. It is used to encrypt data.
- The private key is kept secret by the owner. It is used to decrypt data.
Data encrypted with the public key can only be decrypted by the corresponding private key, and vice versa.
| Feature | Asymmetric Encryption |
|---|---|
| Keys Used | |
| Key Distribution | |
| Speed | |
| Security Context |
In practice, systems like SSL (Secure Sockets Layer) or TLS combine both methods to balance security and speed.
- Authentication: The web browser asks the web server to identify itself. The server sends its digital certificate. A digital certificate is a document that verifies the server's identity, signed by a trusted authority.
- Key Exchange (Asymmetric): The browser uses the server's public key (from the certificate) to encrypt a randomly generated session key. This solves the key distribution problem because the session key never travels across the network in plain text.
- Data Transmission (Symmetric): Both parties now possess the session key. They use this symmetric key to encrypt all subsequent data because symmetric encryption is much faster for large amounts of data.
Correction: Encryption does not stop the data from being intercepted. An attacker can still capture the cipher text packets. The purpose of encryption is to ensure that if the data is intercepted, it remains meaningless and cannot be understood without the decryption key.
Correction: You must specify the key mechanism. For symmetric, explicitly state 'same key'. For asymmetric, explicitly state 'public and private keys'.
Why examiners accept this: Examiners look for the specific sequence of authentication and key exchange. You must mention that asymmetric encryption is used initially to establish trust and share a key, not just for the whole session.
Correct phrasing example: 'The web browser requests the server's identity by asking for its digital certificate. The server sends the certificate, which contains its public key. The browser uses this public key to encrypt a session key. This ensures that only the server (with the matching private key) can decrypt it.'
Note on Digital Certificates: If you mention certificates, clarify they are used for authentication (verifying identity) and contain the public key.
Why examiners accept this: The core advantage is solving the key distribution problem. Symmetric encryption requires both parties to have the same key, which is hard to share securely over an insecure network. Asymmetric encryption allows two parties to communicate without having previously shared any secret keys.
Correct phrasing example: 'Asymmetric encryption allows secure communication between parties who have never met before, because they do not need to exchange a secret key beforehand. The public key can be sent openly, while only the private key remains secret.'
Avoid: Saying 'it is more secure' without explanation. Both methods are secure; asymmetric is just more convenient for key exchange.
- Plain text is encrypted into cipher text using an algorithm and a key. [1]
- The same key is used for both encryption and decryption. [1]
- The cipher text is sent to the receiver. [1]
- The receiver uses the same key to decrypt the cipher text back into plain text. [1]
- Asymmetric encryption allows the public key to be shared openly without risk, solving the key distribution problem. [1]
- It enables the secure exchange of a session key (symmetric key) over an insecure channel, which is then used for faster data transmission. [1]