Introduction to Public-Key Cryptography - Understanding Cryptography - page 149

Modern symmetric algorithms such as AES or 3DES are very secure, fast and
are in widespread use. However, there are several shortcomings associated with
symmetric-key schemes, as discussed below.

Key Distribution Problem The key must be established between Alice and Bob
using a secure channel. Remember that the communication link for the message is
not secure, so sending the key over the channel directly — which would be the most
convenient way of transporting it — can't be done.

Number of Keys Even if we solve the key distribution problem, we must poten-
tially deal with a very large number of keys. If each pair of users needs a separate
pair of keys in a network with n users, there are

n · ( n − 1)

2

key pairs, and every user has to store n 1 keys securely. Even for mid-size net-

works, say, a corporation with 2000 people, this requires more than 4 million key
pairs that must be generated and transported via secure channels. More about this
problem is found in Sect. 13.1.3. (There are smarter ways of dealing with keys
in symmetric cryptography networks as detailed in Sect. 13.2; however, those ap-
proaches have other problems such as a single point of failure.)
No Protection Against Cheating by Alice or Bob Alice and Bob have the same
capabilities, since they possess the same key. As a consequence, symmetric cryptog-
raphy cannot be used for applications where we would like to prevent cheating by
either Alice or Bob as opposed to cheating by an outsider like Oscar. For instance,
in e-commerce applications it is often important to prove that Alice actually sent a
certain message, say, an online order for a flat screen TV. If we only use symmet-
ric cryptography and Alice changes her mind later, she can always claim that Bob,
the vendor, has falsely generated the electronic purchase order. Preventing this is
called nonrepudiation and can be achieved with asymmetric cryptography, as dis-
cussed in Sect. 10.1.1. Digital signatures, which are introduced in Chap. 10, provide
nonrepudiation.

−

Fig. 6.3 Analogy for public-key encryption: a safe with public lock for depositing a message and
a secret lock for retrieving a message