I think you're underestimating the value of contacting someone you've never talked to before, and you're overestimating the complexity of a public-key system.

Any time you want to contact someone new using symmetric encryption, you have to "tell them [the shared key] in person, read it over the phone, use One Time Secret," etc. You have to contact the person over the phone or in person before you can contact them online, which seems to put a serious dent in the utility of encrypted communication. For public key crypto, the keys can be published online in a public repository (or, even better, many online repositories), eliminating this disadvantage. (Analogously, consider a world where it's impossible to build a public telephone book or pass along a phone number to a friend: in order to call someone, you must first meet them in person to add them to your private phone book.)

Note that, when using public key crypto, in order to link a key to a personal identity, you still need out-of-band communication (e.g., key signing parties), but the major advantage is that you can build a public web of trust. If Alice wants to send a message to Bob, she can inspect the work for dozens of others who have already met Bob in person. There is no need for her to call Bob on the phone before emailing, because she has access to his public key and access to many public cryptographic attestations of the validity of the { key, identity } pairing she found for Bob. (Hopefully some of these attestations come from someone she trusts, or someone who is trusted by someone she trusts.)

You say that:

Symmetric encryption therefore is... simpler than asymmetric – one key instead of four for Alice and Bob.

But the number of actual keys is not strictly relevant: we should instead consider the number of keys needed by each party. Each party in public-key crypto has to manage

1. their own private key,
2. their own public key, and
3. one public key for each person they want to contact.

Suppose there are n people who communicate with one another. In your imagined symmetric system, the number of keys held by each party is n. In an asymmetric system, the number of keys held by each party is n+2. Assuming a large number of participants n, that's not a significant difference at all. (In amortized terms, they're both O(n).)

I think you're underestimating the value of contacting someone you've never talked to before, and you're overestimating the complexity of a public-key system.

Any time you want to contact someone new using symmetric encryption, you have to "tell them [the shared key] in person, read it over the phone, use One Time Secret," etc. You have to contact the person over the phone or in person before you can contact them online, which seems to put a serious dent in the utility of encrypted communication. For public key crypto, the keys can be published online in a public repository (or, even better, many online repositories), eliminating this disadvantage. (Analogously, consider a world where it's impossible to build a public telephone book or pass along a phone number to a friend: in order to call someone, you must first meet them in person to add them to your private phone book.)

Note that, when using public key crypto, in order to link a key to a personal identity, you still need out-of-band communication (e.g., key signing parties), but the major advantage is that you can build a public web of trust. If Alice wants to send a message to Bob, she can inspect the work for dozens of others who have already met Bob in person. There is no need for her to call Bob on the phone before emailing, because she has access to his public key and access to many public cryptographic attestations of the validity of the { key, identity } pairing she found for Bob. (Hopefully some of these attestations come from someone she trusts, or someone who is trusted by someone she trusts.)

You say that:

Symmetric encryption therefore is... simpler than asymmetric – one key instead of four for Alice and Bob.

But the number of actual keys is not strictly relevant: we should instead consider the number of keys needed by each party. Each party in public-key crypto has to manage

1. their own private key,
2. their own public key, and
3. one public key for each person they want to contact.

Suppose there are n people who communicate with one another. In your imagined symmetric system, the number of keys held by each party is n-1 (one key for each other person). In an asymmetric system, the number of keys held by each party is (n-1)+2 => n+1 (one key for each other person, plus your own keypair). Assuming a large number of participants n, that's not a significant difference at all. (In amortized terms, they're both O(n).)

I think you're underestimating the value of contacting someone you've never talked to before, and you're overestimating the complexity of a public-key system.

Any time you want to contact someone new using symmetric encryption, you have to "tell them [the shared key] in person, read it over the phone, use One Time Secret," etc. You have to contact the person over the phone or in person before you can contact them online, which seems to put a serious dent in the utility of encrypted communication. For public key crypto, the keys can be published online a public repository (or, even better, many online repositories), eliminating this disadvantage. (Analogously, consider a world where it's impossible to build a public telephone book: in order to call someone, you must first meet them in person or send them a letter to add them to your private phone book.)

Note that, when using public key crypto, in order to link a key to a personal identity, you still need out-of-band communication (e.g., key signing parties), but the major advantage is that you can build a public web of trust. If Alice wants to send a message to Bob, she can inspect the work for dozens of others who have already met Bob in person. There is no need for her to call Bob on the phone before emailing, because she has access to his public key and access to many public cryptographic attestations of the validity of the { key, identity } pairing she found for Bob. (Hopefully some of these attestations come from someone she trusts, or someone who is trusted by someone she trusts.)

You say that:

Symmetric encryption therefore is... simpler than asymmetric – one key instead of four for Alice and Bob.

But the number of actual keys is not strictly relevant: we should instead consider the number of keys needed by each party. Each party in public-key crypto has to manage

1. their own private key,
2. their own public key, and
3. one public key for each person they want to contact.

Suppose there are n people who communicate with one another. In your imagined symmetric system, the number of keys held by each party is n. In an asymmetric system, the number of keys held by each party is n+2. Assuming a large number of participants n, that's not a significant difference at all. (In amortized terms, they're both O(n).)

I think you're underestimating the value of contacting someone you've never talked to before, and you're overestimating the complexity of a public-key system.

Any time you want to contact someone new using symmetric encryption, you have to "tell them [the shared key] in person, read it over the phone, use One Time Secret," etc. You have to contact the person over the phone or in person before you can contact them online, which seems to put a serious dent in the utility of encrypted communication. For public key crypto, the keys can be published online in a public repository (or, even better, many online repositories), eliminating this disadvantage. (Analogously, consider a world where it's impossible to build a public telephone book or pass along a phone number to a friend: in order to call someone, you must first meet them in person to add them to your private phone book.)

Note that, when using public key crypto, in order to link a key to a personal identity, you still need out-of-band communication (e.g., key signing parties), but the major advantage is that you can build a public web of trust. If Alice wants to send a message to Bob, she can inspect the work for dozens of others who have already met Bob in person. There is no need for her to call Bob on the phone before emailing, because she has access to his public key and access to many public cryptographic attestations of the validity of the { key, identity } pairing she found for Bob. (Hopefully some of these attestations come from someone she trusts, or someone who is trusted by someone she trusts.)

You say that:

Symmetric encryption therefore is... simpler than asymmetric – one key instead of four for Alice and Bob.

But the number of actual keys is not strictly relevant: we should instead consider the number of keys needed by each party. Each party in public-key crypto has to manage

1. their own private key,
2. their own public key, and
3. one public key for each person they want to contact.

Suppose there are n people who communicate with one another. In your imagined symmetric system, the number of keys held by each party is n. In an asymmetric system, the number of keys held by each party is n+2. Assuming a large number of participants n, that's not a significant difference at all. (In amortized terms, they're both O(n).)