Application Data Protection Techniques - Secure Java: For Web Application Development - page 164

Asymmetric Encryption
Algorithm

Message Encrypts Message

Scott's Public
Key

Bob - he Sender

Asymmetric Encryption
Algorithm

Decrypts Message

Scott's Private
Key

Scott - he Recipient

Figure 8.4 Asymmetric encryption—Use of public-private keypair for encryption.

◾ Symmetric cryptography requires a secure method of key distribution. As there is only a

single key for encryption and decryption, the chances of loss of data conidentiality are
high during the key exchange, as the keys can be intercepted by an attacker, who could use
them to decrypt the data. his problem is not one that would be associated with asymmetric
cryptography. he public key may be distributed to anyone, but the individual's private key
needs to be kept secret.
Symmetric cryptography sufers from the drawback of scalability. Several complications ◾

could arise in trying to maintain secrecy over multiple keys being present in a system, as
opposed to asymmetric cryptography.
Asymmetric cryptography is not only slower but also needs to have a much larger key size for ◾

it to be as efective as a symmetric algorithm of a much lower keyspace.

Several cryptographic implementations are based on a hybrid method of cryptography, which
combines a symmetric and asymmetric cryptographic system. We already understand that asym-
metric cryptographic algorithms are not suitable for encryption of large chunks of data, and we
are aware that symmetric cryptography has the disadvantage of the need for a secure transport and
scalability factor. he hybrid encryption system addresses these problems. he hybrid encryption
system is explained in the form of an example:

◾ Bob obtains Scott's public key.

◾

Bob generates a symmetric key and encrypts his message “Please don't come to my oice”

with the symmetric encryption key.
Bob then encrypts the symmetric key with Scott's public key. ◾

◾ Bob sends both the encrypted symmetric key (encrypted with Scott's public key) and the

message (encrypted with the symmetric key) to Scott, who reads it.