0

Here and there and read a lot of articles and blog posts titled "Difference Between Symmetric Cryptography and Asymmetric Cryptography". But inside of them they are answered "What is Symmetric Cryptography? What is Asymmetric Cryptography?" only.

My question is:

  • In a war between Symmetric algorithms and Asymmetric algorithms for a project, which one is the winner? (Two algorithm with equal bits of security).

And yes, I know that it depends on the project conditions. The problem is that my colleague's interest to Asymmetric algorithms is an unfounded sense of mind only (Maybe because of the tremendous difference between key-length and calculation times).

So, I explain to different requirements in our project, and I hope you can convince us that which one is better for which case:

The project:

There are two entities. A customer and a Seller. Both have their own Smart Cards. Reading and Writing on Customer's card by the desktop application is allowed only if the Seller has his/hes smart card connected to that computer.

Ok, this is my requirement:

Requirement 1:

There must be a mechanism for Customer card to detect existence of Seller card. I have to option.

1- A Symmetric Key is loaded on both cards. They exchange two random challenges between each other and from the response, detect existence or absence of the other card.

2- Customer or Seller card has loaded with a their private keys that the related public keys are available inside the other card "Only". Each one generate a challenge inside and encrypt it with other entity public key and then sent it to other card. That card decrypt it with its own private key and re-encrypt it with public key of challenge sender and sent the result to it and ....

Requirement 2:

We need to have an encrypted communication between PC and Cards?

Please choose better choice for all cases:

Case1: Only Req1 is needed.

Case2: Only Req2 is needed.

Case3: Both Req1 and Req2 is needed.

Simply, I appreciate you if let me know their use cases. I mean which cases Asymmetric is better and which cases Symmetric is better?

As a side question, in view of can you please sort AES128, AES192, AES256, RSA1024, RSA2048, ECC160, ECC224, ECC256, ECC384 based on calculation time/speed and security strength? (A did a google search, and found this page comparing approximate strength)

closed as off-topic by Deer Hunter, Mark Buffalo, Xander, Adi, SilverlightFox Feb 26 '16 at 18:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, SilverlightFox
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Please read a normal book on applied cryptography (including protocol design), and not some random blog posts. – Deer Hunter Feb 26 '16 at 17:50
  • 3
    Everything: the frame of mind, the notions, the requirements... You don't think about possible fraud, cheating and other attacks on the system. – Deer Hunter Feb 26 '16 at 17:52
2

Don't roll your own crypto.

But if you have to, read a proper book on crypto like Cryptography Engineering or Applied Cryptography.

Symmetric and asymmetric crypto are used for different things. It is very common they are used together.

Use asymmetric crypto (slow) to establish a symmetric crypto key (fast).

Not the answer you're looking for? Browse other questions tagged or ask your own question.