Asymmetric Encryption
Encryption using a mathematically related key pair -- a public key that may be shared freely and a private key that must not be -- so that anyone can encrypt to a recipient, or verify a signature, without holding the secret. It solves the key-distribution problem that symmetric encryption cannot, at the cost of being orders of magnitude slower, which is why real systems use it to exchange or protect a symmetric key and then encrypt bulk data symmetrically. Asymmetric cryptography underpins TLS, PKI and code signing and is examined in Security+, CISSP, SSCP and Cryptography Fundamentals.
Why It Matters
In practice the exam-and-interview trap is direction: you encrypt to someone with THEIR public key so only their private key can read it, but you sign with YOUR private key so anyone can verify it with your public key. Confidentiality and authenticity use the pair in opposite directions, and candidates routinely invert one. The performance asymmetry explains the hybrid design of essentially every protocol -- TLS uses asymmetric operations for authentication and key agreement and then a symmetric cipher such as AES for the session, because encrypting a video stream with RSA would be unusable. The other practical point is that a public key is only as trustworthy as the binding between it and an identity, which is the entire reason PKI, certificates and certificate authorities exist. On exams such as Security+ and CISSP, expect questions on which key performs which operation, and why hybrid encryption is used.
Practice this topic
Test your knowledge of Asymmetric Encryption concepts with exam-style practice questions.
Related Cryptography terms
Encryption
The process of converting plaintext data into an unreadable format (ciphertext) using a cryptographic algorithm and key, ensuring that only authorized parties can access the original information. Encryption can be symmetric (same key for encryption and decryption, e.g., AES) or asymmetric (public/private key pair, e.g., RSA). Data can be encrypted at rest (stored data), in transit (network communication via TLS), or in use (homomorphic encryption). Encryption is mandated by regulations like GDPR, HIPAA, and PCI DSS for protecting sensitive data. It is a fundamental topic across all cybersecurity certifications.
Hashing
A one-way function that converts input data of any size into a fixed-length string of characters (hash value or digest), used primarily for data integrity verification and password storage. Unlike encryption, hashing is irreversible, you cannot recover the original data from the hash. Common algorithms include SHA-256, SHA-3, and bcrypt (for passwords). Hashing is used in digital signatures, file integrity monitoring, blockchain, and password authentication. Collision resistance (ensuring two different inputs don't produce the same hash) is a critical property tested in CISSP and Security+ cryptography domains.
Public Key Infrastructure (PKI)
A set of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and public keys. PKI enables secure electronic communication through certificate authorities (CAs) that issue and validate certificates, registration authorities (RAs), and certificate revocation lists (CRLs) or OCSP responders. PKI underpins HTTPS/TLS, email encryption (S/MIME), VPNs, code signing, and digital signatures. Understanding PKI hierarchy (root CA, intermediate CA, end-entity certificates) is essential for CISSP, Security+, and CCSP certifications.
Digital Certificate
An electronic document issued by a Certificate Authority (CA) that binds a public key to an entity's identity, enabling encrypted communication and identity verification. Certificates follow the X.509 standard and contain the subject's name, public key, issuer, validity period, and digital signature. Types include SSL/TLS certificates (for websites), code signing certificates, email certificates (S/MIME), and client certificates. Certificate validation involves checking the chain of trust, expiration date, and revocation status. Digital certificates are a core component of PKI and are tested in CISSP, Security+, and CCSP exams.
AES (Advanced Encryption Standard)
A symmetric block cipher algorithm adopted by the U.S. government as the standard for encrypting electronic data, replacing the older DES standard. AES operates on 128-bit blocks and supports key sizes of 128, 192, or 256 bits, with AES-256 being the strongest. It uses substitution-permutation network rounds (10, 12, or 14 rounds depending on key size) and is considered computationally secure against brute-force attacks. AES is used in TLS/HTTPS, disk encryption (BitLocker, FileVault), VPNs, and Wi-Fi security (WPA2/WPA3). It is the most widely tested symmetric algorithm in CISSP and Security+ exams.
TLS (Transport Layer Security)
A cryptographic protocol designed to provide secure communication over a computer network by encrypting data in transit between two parties (e.g., a web browser and server). TLS replaced its predecessor SSL and operates through a handshake process that negotiates cipher suites, authenticates the server (and optionally the client) via certificates, and establishes session keys. TLS 1.3 (the latest version) improved performance by reducing handshake round trips and removing insecure cipher suites. HTTPS is simply HTTP over TLS. Understanding TLS versions, cipher suites, and certificate validation is essential for Security+, CISSP, and web security certifications.