It's a common belief hybrid cryptosystems are better than asymmetric only. Is that allways like that?
What's the benefit of using symmetric and asymmetric encryption for small data blocks (< 100 bytes)?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If you have messages to send, and you use an asymmetric encryption algorithm, and that algorithm happens to be able to process each message wholesale because the messages are small enough, then indeed you can design the protocol without any recourse to extra symmetric encryption.
However this may lose some flexibility, and have a non-trivial performance cost. The flexibility is about the possibility to replace, in an ulterior version of the protocol, the asymmetric encryption algorithm (e.g. RSA) with another algorithm that can only do key-exchange (e.g. Diffie-Hellman); in the latter case, you absolutely need to couple it with symmetric encryption.
For the performance, a critical point is whether you envision two parties to send to each other several messages in a short time. With "pure RSA" and a 4096-bit RSA key, each encrypted message will need 512 bytes. With an hybrid system, successive messages may reuse an already negotiated session key, and thus need only 120 bytes or so (if the plaintext messages are about 100-byte long). Of course there is also the issue of CPU cost (RSA-4096 decryption are not exactly free), but network bandwidth issues are often more important.
Take note that if several messages are sent and each of them is encrypted separately, then it is your responsibility to include in the messages something which allows the recipient to detect whether some messages were dropped, or duplicated, or arrived out-of-order. You may also want to add some specific countermeasures to detect alterations of messages, and completely phony messages.
More generally, with RSA encryption, the public key is public, hence everybody can use the key to encrypt messages. If you have a notion of a "stream of messages" then you will need some more crypto to avoid external insertion of extra messages. This is linked with notions of authentication. There again, systems that rely on hybrid encryption can reuse an initial handshake procedure, and thus guarantee that all messages protected (through symmetric encryption and MAC) with a given session key all come from the same source.
If you do decide to use asymmetric crypto alone, you must include some randomness in each message. If you don't:
Suppose an eavesdropper captures a military communication and he knows the message will be one of two things:
Although he can't decrypt the message, he knows the public key, so he can try encrypting each possible message in turn, and see if it matches the ciphertext.
It's because of subtleties like this that people always say "don't roll your own crypto".