This question often comes up in conversations about authentication/authorization, the difference between HTTP and HTTPS, and TLS. Below we briefly go over how symmetric and asymmetric keys differ, along with their advantages and disadvantages.
Symmetric key
Symmetric encryption is when the same key is used both to encrypt and to decrypt data. Since only one key is involved, this approach is very simple to use, and encrypting/decrypting data is much faster than with asymmetric encryption.
The obvious drawback of this approach is security. Both parties (the one encrypting and the one decrypting) must obtain the same key, but if it is transmitted insecurely, an attacker can read all messages encrypted with that key. This can be mitigated, and two approaches are most commonly used:
- Using asymmetry to derive a shared symmetric key.
- Using third-party key management services, for example AWS KMS, GCP KMS, Azure Key Vault…
Asymmetric key
Asymmetric encryption is when we use a pair of keys: a public key for encrypting and a private key for decrypting data. It has a number of advantages over symmetric encryption thanks to better security and flexibility.
How a public/private key pair works is a separate question that you will definitely hear in an interview, so we made it a standalone question. You can read it here.
This approach has drawbacks too, for example:
- From a CPU standpoint, asymmetric encryption is much more expensive, which is a problem with large volumes of data, so asymmetry is usually used to exchange a secret, while symmetric encryption is used for the actual encryption/decryption.
- Key management is quite a difficult task with this approach. That is why implementing key rotation, key revocation, access control… is mostly offloaded to a third party such as AWS KMS.