Basics of Cryptography: Symmetric vs. Asymmetric Encryption and Hashing

Imagine you have a diary. It contains your most private thoughts, your fears, your secrets. Now imagine you need to send that diary across a city, but the only way to do it is to hand it to a series of strangers who will pass it from person to person until it reaches your trusted friend. Any one of those strangers could stop, open the diary, and read every word. What would you do? You might write in a secret code that only your friend understands. You might lock the diary in a box. You might find a way to prove to your friend that the diary arrived without anyone tampering with it. These three instincts — hiding meaning, locking content, and verifying integrity — are exactly what the science of cryptography is built on. Cryptography is the study and practice of keeping communication secure from people who are not supposed to read it. The word comes from the ancient Greek words for "hidden" and "writing." But today, cryptography is not just about hiding words on paper. It is the invisible foundation holding together almost everything you do online. When you log into your bank account, when you send a private message, when you buy something with a credit card, cryptography is working silently in the background to keep you safe. Today we are going to explore three of the most important ideas in modern cryptography: symmetric encryption, asymmetric encryption, and hashing. By the end of this lesson, you will understand not only how these tools work, but why they exist, what problems each one solves, and how they connect together to protect the digital world we live in. Let us begin at the very beginning. When we talk about encryption, we are talking about a process of transformation. You start with readable information — cryptographers call this plaintext. You run it through a process using a special piece of information called a key — think of a key as a secret recipe or a password. The result is scrambled, unreadable information called ciphertext. This scrambling process is called encryption. When the right person wants to read the message, they run the ciphertext through the reverse process using a key, and they get the plaintext back. This reverse process is called decryption. Here is a very simple example to make this concrete. Suppose your key is the instruction "replace every letter with the letter that comes three places after it in the alphabet." So the letter A becomes D, B becomes E, C becomes F, and so on. If your message is the word CAT, your ciphertext becomes FDW. To anyone who does not know the key, FDW is meaningless noise. But your friend, who knows the rule, can reverse it and read CAT. This simple method, which was actually used by Julius Caesar over two thousand years ago and is called the Caesar cipher, captures the essential idea of encryption: use a shared secret to scramble and unscramble a message. Modern encryption is vastly more complex and mathematically sophisticated than the Caesar cipher, but the underlying concept remains the same. Now let us look at the first major type of modern encryption. Symmetric encryption is the simpler and older of the two main types of encryption. The word symmetric means "the same on both sides." In symmetric encryption, the same key is used both to encrypt the message and to decrypt it. Both the sender and the receiver must have identical copies of the same secret key. That is why it is called symmetric — the setup is the same on both sides of the communication. Think about this with a physical analogy. Imagine your friend Alice wants to send a very sensitive document to her colleague Bob, who lives in another city. She places the document in a strongbox and locks it with a padlock. She has a key to that padlock, and so does Bob — they made copies of the same key when they met last year. She sends the locked box through the postal service. Even if someone intercepts the box, they cannot open it because they do not have the key. When Bob receives it, he uses his copy of the same key to unlock the box and take out the document. This is symmetric encryption in its essence. Alice and Bob share one secret key. That key locks and unlocks everything. The most important symmetric encryption algorithm used in the world today is called AES, which stands for Advanced Encryption Standard. It was adopted by the United States government in 2001 and is now the global standard for protecting sensitive information. AES takes your data and a key, and it runs the data through a highly complex series of mathematical transformations — mixing, shifting, substituting — that result in ciphertext that looks like complete random noise to anyone without the key. The key itself is typically 128, 192, or 256 bits long. A bit is the smallest unit of digital information, either a zero or a one. A 256-bit key means there are two to the power of 256 possible keys — a number so astronomically large that even if every computer on Earth tried every possible key, it would take longer than the age of the universe to find the right one by guessing. The great strength of symmetric encryption is speed. Because the mathematics involved, while complex, is designed to run efficiently on computer hardware, AES can encrypt enormous amounts of data very quickly. When your laptop encrypts your entire hard drive — a process called disk encryption, which programs like BitLocker on Windows and FileVault on Apple Mac computers perform — it uses AES because it needs to be fast enough not to slow down your work. When data travels securely across a Wi-Fi network, AES is working furiously, encrypting every packet of information many times per second. But symmetric encryption has one deep, troubling weakness. Think back to Alice and Bob and their shared key. How did they get matching keys in the first place? In the story, they met in person last year and made copies. But what if Alice needs to send a secret message to someone she has never met, someone on the other side of the world, someone she can only contact through the internet — which is a public, open network where anyone might be watching? If Alice tries to send the key to Bob over the internet before they start communicating, an attacker who is monitoring the connection could intercept the key. Once the attacker has the key, they can decrypt everything. Alice cannot encrypt the key before sending it, because that would require Bob to already have a key to decrypt it — and we are back to the same problem. This circular dilemma is called the key exchange problem. It is one of the most fundamental challenges in the history of cryptography, and it stumped mathematicians for centuries. For thousands of years, the only solution was to exchange keys in person, in advance, through a trusted physical courier. Militaries would print books of secret keys and physically deliver them to commanders before battles. Banks would send key information to branches by armored car. This works, but it is slow, expensive, and simply does not scale to a world where millions of people need to communicate securely with strangers every day on the internet. The solution to the key exchange problem was one of the most revolutionary intellectual breakthroughs of the twentieth century, and it gave birth to our second major type of encryption. Asymmetric encryption, also called public-key cryptography, was developed in the 1970s. It overturned a fundamental assumption that had held for thousands of years: the assumption that the key to lock a message and the key to unlock it must be the same, or at least must be kept secret. Asymmetric encryption uses two different keys that are mathematically linked: a public key and a private key. They are created together as a pair. What one key locks, only the other key can unlock. Let us use an analogy to understand this. Imagine Bob has a very special kind of mailbox. This mailbox has a slot on the front where anyone can drop letters in. But the slot only works one way — once a letter is inside, it cannot be pulled back out through the slot. The only way to retrieve letters is to use a special physical key that Bob keeps on his person at all times and never shares with anyone. Bob does something smart: he makes thousands of copies of his mailbox address — which in this analogy represents his public key — and he gives them to everyone he knows. He posts it on his website. He puts it in a public directory. He hands it out freely, because there is no danger in people knowing where his mailbox is. Anyone can drop a letter in. But only Bob, with his private key, can open the box and read what is inside. Now suppose Alice wants to send Bob a secret message. She looks up Bob's public key — remember, it is freely available — and she uses it to encrypt her message. She sends the resulting ciphertext to Bob. Now here is the beautiful and extraordinary part: even Alice herself, who just created the ciphertext, cannot decrypt it. Only Bob's private key can do that. She does not know his private key — nobody does except Bob. So she sends her encrypted message over the open internet, completely unconcerned about who might be watching, because what they see is useless to them without Bob's private key. This solves the key exchange problem entirely. Alice and Bob never needed to meet. They never needed to share a secret in advance. Alice used a key that was always public. Bob uses a key he has always kept private. The mathematics underlying asymmetric encryption is elegant and fascinating. The most famous algorithm is called RSA, named after its inventors Rivest, Shamir, and Adleman who published it in 1977. RSA works by exploiting a mathematical asymmetry: it is extremely easy to multiply two large prime numbers together, but it is extraordinarily difficult — even for powerful computers — to take the result and work backwards to find the original two prime numbers. A prime number is a number that can only be divided evenly by one and itself, like 2, 3, 5, 7, 11, and so on. When you generate an RSA key pair, you pick two enormous prime numbers, multiply them together, and use that product as the basis for your public key. Your private key is derived from the original two prime numbers. Anyone with your public key has the product. But they would need to factor that product — find the two original primes — to derive your private key, and for the number sizes used in modern RSA, this factoring problem would take classical computers millions of years. A more modern alternative to RSA is called Elliptic Curve Cryptography, or ECC. ECC is based on a different mathematical structure involving the geometry of elliptic curves — specific types of smooth mathematical curves with special algebraic properties. What matters for us is the practical result: ECC provides the same level of security as RSA but requires much smaller keys. A 256-bit ECC key is roughly equivalent in security to a 3072-bit RSA key. Smaller keys mean less data to transmit and less computation required, which is why ECC is especially popular for mobile phones and devices with limited computing power. Asymmetric encryption has another extraordinarily useful property that goes beyond confidentiality. It can be used in reverse to create what are called digital signatures. Remember that in normal use, Alice encrypts with Bob's public key and Bob decrypts with his private key. But suppose Alice does something different: she encrypts a message with her own private key. Now anyone who has Alice's public key — which is freely available — can decrypt it. This does not achieve secrecy, because anyone can read it. But it achieves something else just as valuable: it proves the message came from Alice and only Alice. Nobody else has Alice's private key. If the message can be decrypted with Alice's public key, it must have been created with Alice's private key, and only Alice has that. This is the digital equivalent of a handwritten signature or a personal seal. It proves authorship and prevents someone from later claiming they did not send the message. Digital signatures are used everywhere. When your computer installs a software update, it checks a digital signature to verify that the update genuinely came from the software company and has not been tampered with by someone in the middle. When your government signs an official digital document, it uses a private key only it controls. When a cryptocurrency transaction is broadcast to a network, it includes a digital signature proving that the owner of those funds authorized the transfer. Now, asymmetric encryption is not perfect. Its great weakness is speed. The complex mathematics involved — the factoring problems, the elliptic curve calculations — are computationally expensive. Asymmetric encryption can be hundreds or even thousands of times slower than symmetric encryption. This makes it completely impractical for encrypting large amounts of data, like streaming a video or transferring a large file. So we have a situation where symmetric encryption is fast but has a key exchange problem, and asymmetric encryption solves the key exchange problem but is too slow for bulk data. The solution used in almost every secure system in the world today is brilliant in its simplicity: use both. This approach is called a hybrid encryption system. Here is exactly how it works, using the example of your web browser connecting to a secure website — one whose address starts with https, where the s stands for secure. The security protocol responsible for this is called TLS, which stands for Transport Layer Security. You may also have heard it called SSL, which stands for Secure Sockets Layer — an older name that people still commonly use. When you connect to your bank's website, your browser and the bank's server go through a process called the TLS handshake. A handshake in networking means an initial exchange of information to establish the rules and keys for a secure connection. During this handshake, your browser uses the bank's public key — which is contained in the bank's digital certificate, a kind of verified identity document — to encrypt a freshly generated random number. This random number will be used to create a symmetric session key, meaning a key that will only be used for this one browsing session. Your browser sends the encrypted random number to the bank. The bank decrypts it using its private key. Now both your browser and the bank have the same symmetric session key, and nobody watching the connection ever saw it transmitted in the clear. The asymmetric encryption served its purpose: it solved the key exchange problem. Now, for all the actual communication — sending your password, loading your account balance, processing your transfer — both sides use the fast symmetric session key with AES. The heavy lifting of encryption is done efficiently, and the tricky problem of key exchange was solved securely. This hybrid model is so effective that it underlies virtually all secure communication on the internet. Every time you see that small padlock icon in your browser's address bar, you are seeing the result of this partnership between asymmetric and symmetric encryption. Now we turn to the third pillar of our lesson, which is quite different in nature from the first two. It is called hashing. Encryption, whether symmetric or asymmetric, is about confidentiality — keeping the content of a message secret from people who should not see it. Hashing is not about confidentiality at all. Hashing is about integrity — verifying that information has not been changed or tampered with. It answers a different question. Not "can you read this?" but "has this been altered?" A hash function is a mathematical process that takes any input — a short password, a long document, an entire movie file — and produces a fixed-size string of characters as output. This output is called a hash, or sometimes a digest. The crucial property is that the hash function runs in only one direction. Given an input, you can easily calculate the hash. But given only the hash, it is computationally infeasible — meaning practically impossible — to work backwards and find the original input. This is why hashing is called a one-way function. Think of a blender as an analogy. You put ingredients into a blender — strawberries, a banana, some yogurt — and you turn it on. You get a smoothie. The smoothie is your hash. You could look at the smoothie all day and you would never be able to reconstruct the exact original ingredients. You might guess there are strawberries in it, but you could not determine whether it was five strawberries or six, whether it was Greek yogurt or regular yogurt, whether the banana was ripe or slightly green. The process of blending is the one-way function. Furthermore, if you changed even one ingredient — swapped one strawberry for a blackberry — the resulting smoothie would look noticeably different. This is called the avalanche effect, and it is one of the most important properties of a cryptographic hash function. The avalanche effect means that even the tiniest change in the input produces a completely different and unpredictable output. Here is a real example using the hash function SHA-256, which stands for Secure Hash Algorithm producing a 256-bit output. If you feed the phrase "Hello, world" into SHA-256, you get a specific 64-character string of letters and numbers. If you change just one character — making it "hello, world" with a lowercase h — you get a completely different 64-character string that bears no resemblance to the first. The two outputs are as different as they would be if the two inputs had nothing in common. This property makes hashes extraordinarily useful for detecting tampering. Suppose you download a large software file from the internet. The software company, on their website, publishes the SHA-256 hash of the legitimate file. After you download the file, you run SHA-256 on your downloaded copy and compare your result to the one on the website. If they match, you have mathematical proof that your file is identical to the original — not a single bit has been changed during download, and no attacker has sneaked malicious code into it. If they do not match, something has changed in the file, and you should not trust it. Now let us talk about one of the most important practical uses of hashing: storing passwords. When you create an account on a website and choose a password, what does the website store? If the website stores your actual password — the text you typed — then if someone breaks into the website's database, they immediately have your password. They can log into your account, and since many people reuse passwords, they might be able to log into your email, your bank, and dozens of other accounts. This has actually happened many times to large companies with careless security practices. It is a catastrophic outcome. A responsible website does not store your password at all. Instead, when you create your account, the website runs your password through a hash function and stores only the resulting hash. Your actual password is never saved anywhere. When you log in, you type your password again. The website hashes whatever you typed and compares the resulting hash to the stored hash. If they match, you typed the right password and you are granted access. If they do not match, you typed the wrong password and access is denied. At no point does the website need to know your actual password. Now suppose an attacker breaks into the database and steals all the stored hashes. What can they do? Because hashing is one-way, they cannot simply reverse the hashes to find the original passwords. They are stuck with a long list of meaningless strings of characters. Getting from those hashes back to your password is, in principle, computationally infeasible. Responsible systems take this one step further using a technique called salting. A salt is a random piece of data that is generated uniquely for each user and added to their password before it is hashed. So instead of hashing just "mypassword", the system might hash "mypassword" combined with a random string like "xK9r7pQ2". The salt is stored in the database alongside the hash, which is fine because the attacker would still need to guess the password and combine it with the correct salt and hash the result and see if it matches — and they would have to do this separately for every single user account. This makes large-scale attacks enormously more difficult. Hashing also lies at the heart of one of the most important technological innovations of the past decade: blockchain technology, which underlies cryptocurrencies like Bitcoin. A blockchain is a sequence of records — called blocks — where each block contains some data and also contains the hash of the previous block. Because of the avalanche effect, if anyone tries to go back and alter an old block — perhaps to change a transaction record — the hash of that block changes. But wait: the next block contains the old hash of the modified block. Now that does not match either, so the hash stored in the block after that does not match, and so on throughout the entire chain. Changing one old record invalidates every subsequent record in the chain, making the history tamper-evident. This is how blockchain systems achieve their much-discussed property of immutability, meaning the records, once written, effectively cannot be altered without it being obvious. Now that we have explored all three concepts in depth, let us pause and consider a profound and increasingly urgent question that shadows all of modern cryptography: the threat posed by quantum computers. A quantum computer is a fundamentally different type of computing machine that exploits the principles of quantum physics — the strange rules governing the behavior of matter at the smallest scales, where particles can exist in multiple states simultaneously. Classical computers, including your laptop and phone, process information as bits — zeros and ones. A quantum computer uses quantum bits, or qubits, which can exist as zero, one, or both simultaneously in a property called superposition. This allows a sufficiently powerful quantum computer to explore many possible solutions to a problem at the same time, rather than one at a time. The security of RSA and other asymmetric encryption algorithms rests on the fact that factoring enormous numbers into their prime components is computationally infeasible for classical computers. A mathematician named Peter Shor discovered in 1994 that a sufficiently large and powerful quantum computer could run an algorithm — now called Shor's Algorithm — that would solve the factoring problem efficiently, essentially breaking RSA and similar systems. If such a quantum computer were built at sufficient scale, it would render much of the internet's current security infrastructure obsolete overnight. This is not a distant theoretical concern. Governments and technology companies around the world are investing billions of dollars in quantum computing research. The United States National Institute of Standards and Technology, a government agency that sets technical standards, spent years reviewing dozens of proposed new cryptographic algorithms designed to resist quantum attacks. In 2022 and 2024, it announced the first set of standardized post-quantum cryptographic algorithms — encryption methods based on different mathematical problems that are believed to be hard even for quantum computers. Symmetric encryption like AES and hash functions like SHA-256 are considered more resistant to quantum attacks, though experts recommend increasing key and output sizes as a precaution. The most vulnerable are the asymmetric systems we all currently depend on, and the global effort to replace them before sufficiently powerful quantum computers arrive is one of the most important ongoing projects in the history of computing security. There is also a persistent and often underappreciated challenge that does not require quantum computers to cause catastrophic damage: the gap between theoretically secure algorithms and the messy reality of implementing them. A cryptographic algorithm can be mathematically proven to be secure, but if a programmer makes an error when writing the software that uses it, the security can collapse entirely. Real-world breaches are often not caused by breaking the mathematics of encryption. They are caused by using weak passwords that are easy to guess, by generating random numbers that are not truly random, by accidentally leaking key information through the timing of operations, or by failing to verify digital certificates properly. The famous Heartbleed vulnerability, discovered in 2014, was not a flaw in the encryption algorithm itself but in a software implementation that accidentally allowed attackers to read sensitive data from computer memory, including private keys. Implementation mistakes are arguably a greater practical threat than mathematical weaknesses. Let us step back and look at the full picture we have assembled. Cryptography gives us three fundamental tools for protecting information in the digital world. Symmetric encryption uses one shared secret key to lock and unlock data. It is fast and efficient, making it perfect for protecting large amounts of data, but it suffers from the key exchange problem — getting that shared key to another person securely is genuinely difficult. Asymmetric encryption elegantly solves this problem by using a pair of mathematically linked keys, one public and one private. Anyone can use your public key to send you a secure message or verify your identity, but only you — with your private key — can decrypt messages or create signatures that prove they came from you. The price of this magic is speed: asymmetric encryption is much slower. In practice, the best systems combine both: asymmetric encryption to exchange a symmetric key, and symmetric encryption to do the actual heavy lifting of protecting data. Finally, hashing is a one-way process that takes any data and produces a fixed-size fingerprint — a hash. Hashing does not hide data; it verifies it. It protects password databases, ensures downloaded files have not been tampered with, and secures the immutable record chains of blockchain systems. Together, these three tools form the backbone of digital security. They work quietly behind the padlock in your browser, behind the login screen of every website you use, behind every software update you install, and behind every financial transaction you make online. Understanding them is not just academic curiosity. It is literacy for the digital age. In a world where so much of life — communication, commerce, identity, civil records — exists in digital form, understanding the tools that protect that world is as fundamental as understanding how locks and keys work in the physical one. To summarize the key ideas from today's lesson: cryptography transforms readable data into unreadable ciphertext using a process called encryption, and reverses it with decryption. Symmetric encryption uses a single shared key and is very fast, making it ideal for large volumes of data, but the challenge is securely sharing that key. Asymmetric encryption uses a mathematically linked public and private key pair, solves the key exchange problem, enables digital signatures that prove identity, but is much slower than symmetric encryption. Modern secure systems use a hybrid approach, combining both types. Hashing is a one-way transformation producing a fixed-size fingerprint of data, used for verifying integrity rather than hiding content, with important applications in password storage, file verification, and blockchain. And the field of cryptography is not standing still — the emerging threat of quantum computing is driving a global effort to develop new algorithms that will keep our digital world secure for the decades ahead.