I'm reading this pki article and as you can see near the bottom, the quick animation and description:

The sending computer encrypts the document with a symmetric key, then encrypts the symmetric key with the public key of the receiving computer. The receiving computer uses its private key to decode the symmetric key. It then uses the symmetric key to decode the document.

So my question:

1: This description seem to describe asymmetric encryption model, but then why are they encrypting it with a symmetric key?

2: Why bother using a key at all to encrypt the document? Why not just encrypt the document with the public key directly and decrypt it with the private key on the receiving computer?


  • 1
    For Diffie-Hellman/ECIES you simply can't encrypt the document directly. For RSA we don't have any standards for doing this (chaining modes and the like) and it's damn slow, especially at higher security levels. Commented Mar 18, 2014 at 22:13

3 Answers 3


Most asymmetric encryption algorithms are very slow while most symmetric algorithms are quite fast. When you want to encrypt a large file with asymmetric encryption, encrypting and decrypting will take a while. But when you only encrypt the symmetric key, you don't have much data, so it will be quite fast, and you can then use the symmetric key to decrypt the large message quickly.

Hybrid encryption also allows to encrypt the message efficiently for multiple recipients. With asymmetric encryption alone you would have to encrypt the whole message multiple times - once for each recipient. But with hybrid encryption you just need to encrypt multiple copies of the symmetric key while you only need one copy of the message.

Another advantage of hybrid encryption is that you never send the same cyphertext twice. A new symmetric key is (or should be) generated for each message. That means when the same plaintext is encrypted twice to the same receiver, the cyphertexts will look different. When you would use only the public key, both cyphertexts would be identical. This might be exploitable in some situations. For example when an eavesdropper suspects that you sent one of a limited set of known plaintexts encrypted with a public key they also have access to.

  • So this would mean that the document itself is not encrypted by the asymmetric encryption? I guess I thought all traffic via pki is encrypted (so the document is encrypted twice).
    – Mark
    Commented Mar 19, 2014 at 14:21
  • @Mark You thought wrong. A new symmetric key is generated for each document. That key is used to encrypt the document. The key is then encrypted with the public key(s) of the receiver(s) and attached to the document. This, by the way, also protects against known-plaintext attacks (when you would encrypt the same message twice with the same public key, you would get the same cypher-text. An eavesdropper doesn't know that the message you sent was the same you already sent in the past)
    – Philipp
    Commented Mar 19, 2014 at 14:25

The symmetric key is used because symmetric encryption is more efficient.

The public key encryption is used so that the symmetric key can be securely shared.


Symmetric encryption works by mixing secret input with a secret key in such a fashion that it is (a) fast (b) cannot derive the input or key from the output.

Asymmetric encryption works by exploiting very difficult mathematical problems with back doors that enable a fast solution to the problem, if you have a small piece of very important data. The usual mathematical problems are factoring large numbers and discrete logarithms. Asymmetric algorithms work on a fixed data size, typically 1024-2048 bits for RSA and El Gamal, and 384 bits for Elliptic Curve versions of RSA or El Gamal.

Therefore you exchange symmetric key using asymmetric method (which is highly cost) and use shared symmetric key for encryption and decryption(which is fast and effective).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .