symmetric encryption session keys in SSL/TLS

Question

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-private key pairs are superior to symmetric keys regarding key exchange security, why don't use asymmetric encryption for the session keys too?

this is an extension of an existing question: security of PKI, Certificates, certificate authorities, forward secrecy

Answer 1

2 reasons:

1. Asymmetric encryption is slower, much slower, than symmetric encryption. Orders of magnitude slower.
2. Given the same keylength, asymmetric is much weaker than symmetric, bit-for-bit. Therefore, you need a much larger key to provide equivalent protection. This also contributes to the slowness mentioned in 1.
3. (As per @ThomasPornin's comment:) Asymmetric encryption carries with it an increase in size of output. For instance, if you use RSA, encrypted data is at least 10% larger than the cleartext. Symmetric encryption, on the other hand, has a fixed size overhead even when encrypting gigabytes of data.

Answer 2

Asymmetric encryption algorithms are far less efficient than symmetric algorithms. So essentially all use of encryption via asymmetric keys involves encrypting a symmetric session key, with which the actual message is encrypted.

Besides AviD's helpful notes about key length, note that if quantum computing attacks become feasible, they will render all mainstream public-key algorithms ineffective. On the other hand, AES-256 would remain strong even given a quantum computer attack. See Key size - Effect of Quantum Computing Attacks - Wikipedia.