Why not use symmetric encryption?

Question

Something very simple: most of us communicate most of the time with people we already know. Alice and Bob probably have physical contact, too. Yes, there are cases when whistle-blowers want to contact journalists for the first time, but that’s not the problem situation for most of us.

Symmetric encryption therefore is appropriate and simpler than asymmetric – one key instead of four for Alice and Bob. But how do you share the secret key? You tell them in person, read it over the phone, use a One Time Secret or Diffie-Hellman.

Have I missed something? Or is encryption (to protect stuff in transit) just really easy?

Answer 1

If you talk to 1000 persons and use pre-shared symmetric keys, then you have to remember 1000 secret keys. Secret key storage can be hard. With asymmetric encryption you just have to remember only public keys, and that is easy because public keys are public, so they can be "remembered" by being published somewhere, where everybody can see them.

Moreover, you talk to machines more often than you talk to persons. In particular every time you visit an "https://" Web site. How would you, precisely, read a key over the phone with a server ? It is a machine, it has no voice that you would recognize.

Answer 2

I think you're underestimating the value of contacting someone you've never talked to before, and you're overestimating the complexity of a public-key system.

Any time you want to contact someone new using symmetric encryption, you have to "tell them [the shared key] in person, read it over the phone, use One Time Secret," etc. You have to contact the person over the phone or in person before you can contact them online, which seems to put a serious dent in the utility of encrypted communication. For public key crypto, the keys can be published online in a public repository (or, even better, many online repositories), eliminating this disadvantage. (Analogously, consider a world where it's impossible to build a public telephone book or pass along a phone number to a friend: in order to call someone, you must first meet them in person to add them to your private phone book.)

Note that, when using public key crypto, in order to link a key to a personal identity, you still need out-of-band communication (e.g., key signing parties), but the major advantage is that you can build a public web of trust. If Alice wants to send a message to Bob, she can inspect the work for dozens of others who have already met Bob in person. There is no need for her to call Bob on the phone before emailing, because she has access to his public key and access to many public cryptographic attestations of the validity of the { key, identity } pairing she found for Bob. (Hopefully some of these attestations come from someone she trusts, or someone who is trusted by someone she trusts.)

You say that:

Symmetric encryption therefore is... simpler than asymmetric – one key instead of four for Alice and Bob.

But the number of actual keys is not strictly relevant: we should instead consider the number of keys needed by each party. Each party in public-key crypto has to manage

1. their own private key,
2. their own public key, and
3. one public key for each person they want to contact.

Suppose there are n people who communicate with one another. In your imagined symmetric system, the number of keys held by each party is n-1 (one key for each other person). In an asymmetric system, the number of keys held by each party is (n-1)+2 => n+1 (one key for each other person, plus your own keypair). Assuming a large number of participants n, that's not a significant difference at all. (In amortized terms, they're both O(n).)

Answer 3

The problem that asymmetric encryption solves is that it retains control over who can and can't sign/encrypt messages.

Suppose you have a symmetric key K. Alice, Bob, and Eve share this key K so that they can all trade encrypted messages. However, Eve gives a copy of K to Mallory (who has malicious intent) without telling anyone. Now the entire network has been compromised, and Mallory can send and read messages as any other member.

If instead, Alice, Bob, and Eve each had their own private keys A, B and E respectively (with public keys A+, B+ and E+), then when Mallory gets ahold of E, all she can do is read messages intended for Eve, and send messages that it looks like Eve encrypted. We go from a situation in which Eve has compromised the entire network, to a situation where Eve's poor choice only affects messages to/from her.

If you could completely trust all people, then symmetric cryptography would be enough. However, if you could completely trust all people, then you'd be able to send plaintext. ;)

Answer 4

First of all, encryption is made in a way that everyone can use it and only because of you don't need the advantages of private/public key methods doesn't mean it is like this for anyone else. Imagine a person in a country with strong surveillance - he won't be able to get a symetric key in a safe way, but getting a public key is no problem because everyone is allowed to see it.

Another big benefit of asymetric encription is that (in most cases) you can additionally sign your own texts, so you can prove that the message is really from you and it has not been altered on it's way through the internet.

Additional Information

A webservice (onetimesecret for example) is never a good idea to use. You don't really know what is happening with your data, you don't know if it is really safe and I would guess if an agency wanted to look at your 'secret' they wouldn't have too much trouble doing so.

Answer 5

A couple things make it obvious that you don't understand the subject deeply. First and foremost, the javascript library you mention implements RSA, which is asymmetric encryption. Diffie-Hellman is a key sharing scheme that uses asymmetric encryption to share a secret key which is then used for symmetric encryption. You're not avoiding asymmetric encryption with either of those suggestions.

Generally speaking, asymmetric encryption is ill suited to "messages" in the way we, as users, think of messages. First of all, it's strictly size-limited. You can never safely transmit a message over the size allowed by the encryption scheme, where a symmetric cipher allows messages of arbitrary length. Typically, you will use asymmetric encryption as a method to verify identity and as a means of key exchange with a new contact, and it's far better suited to these roles than symmetric encryption is.

Ultimately, a fully functional secure communication system will use asymmetric encryption in concert with symmetric encryption, each to their strengths. One assumes that your issue here is brought up by a minimal understanding of a system like PGP, and the fact that it incorporates asymmetric encryption for protecting email communications. But, if you look closely at the diagram on the wikipedia page, you can see that it's only using public key crypto to encrypt a private key which is used to symmetrically encrypt/decrypt the email message.

Answer 6

A very fun fact is: When using Asymmetric encryption based system, you are mostly using Symmetric encryption ! (It's not mandatory of course, but it would be useless without Symmetric encryption because slow and not as secure (...) ).

==> The Asymmetric part is just used to exchange the Symmetric key !

So, if you have no problems exchanging the key:

• Per person/computer (and you trust that the person is the one she's pretending to be, and the way you do it is secure, ... and other stuff already explained)
• Few hundred random characters long key --> Excessively important (You wouldn't dare use an easily bruteforce-able key, wouldn't you ?)
• Different key each time --> Very important also ... (you never know ;)

Then, if those are not a problem, then sure, it's exactly the same to use only Symmetric encryption... (and if it is a problem then you'll have your answer on "why are we using Asymetric ?" ;)

Edit: Actually it's not exactly the same (as mentioned in comments). For exemple in a conversation between Alice and Bob, you'll have no proof (in a courtroom) on who wrotes the message (was it Alice or Bob ?).

Answer 7

Messages themselves are protected with symmetric key encryption, but the key is shared using asymetric encryption. The Javascript library you cited implements RSA. It, like DH, is an asymmetric key encryption algorithm that is just used to establish a single shared key for protecting the message or session.

Here's why you asymmetric key encryption is valuable:

1: I don't need to talk to you out-of-band before I talk to you securely
1a: Think of the hundreds or thousands of web domains you access daily, and imagine if you had to phone each one (overseas long-distance rates apply) and read off long strings of numbers and letters and hope you don't balls-up the transcription
2: If a key is compromised, I have to call the person or persons who have access to it and read them the new key
3: Who is vouching for me? How do you know I am legit? With PKI, you have a hierarchy of trust. Someone says I am who I claim to be and that I am not malicious, and is staking their reputation on it
4: How do I prove the message has not been changed in-transit? I can't sign it in a way that proves it
5: If I am a website with a million customers, do I REALLY want to store and track a million private keys? What if interacting with me is anonymous? How do I determine which private key to use?
6: C'mon, don't assume crypto is easy. RSA and DH and ECDH came about because it is really hard, and these take it from sucking to being manageable.

And for the person who will be offended from my tone, I am on leave and don't care

Answer 8

Other answers have already covered the important specifics of why various encryption approaches have value, but ultimately, the answer to the question asked:

"Why not use symmetric encryption (for email with a known party)?"

is that one-size does not fit all. The choice of encryption methods, ciphers, algorithms all depend on the threat model you wish to protect against. Symmetric encryption is very useful for what it does, but mis-using it will negate any protection it could offer.

Why is Alice encrypting information to Bob? Who doesn't she want to read it? (Confidentiality) Does she want to prove it was she who sent it? (Authenticity) Does she care if only Bob gets to read it, or is it ok if Bob gives the key to someone else? How about the admin of Bob's machine for storage of the data at rest?

Answer 9

You're missing the property called forward secrecy.

In a private system, I share a key with Alice. Suppose Alice is raided by the Stasi and they seize a computer which has the key. They can then use that key to decrypt all the messages we have ever exchanged!

In a public key system, I can give a key to Alice and that enables her to create encrypted messages that nobody other than me can read. Including Alice, and whoever seizes Alice's computer. Usually this involves a per-session symmetric key and is called "perfect forward secrecy".

Answer 10

If Alice sends a symmetrically encrypted message to Bob, and Bob leaks the key, now every message Bob sends to Alice can be eavesdropped by third parties.

If the key is asymmetric, your only hope is to snoop on Bob while he is still writing Alice's key pre-encryption. He could, of course, deliberately leak every plaintext he sends - but if he is not malicious, and only leaked Alice's key accidentally (or maybe it was stolen and he doesn't know), asymmetric nullifies the problem. Leaking private key is very bad. Leaking public key - who cares?

Because nobody cares that your public key is leaked, you might as well leak it yourself. If you leak it well enough, by broadcasting all over the net from public servers, you can even assume that everyone already has your key (or can get it). Now Alice's other problem is solved - how to get a key to Bob in the first place.