Lesson 1 of 4 · 9 min
Symmetric encryption, asymmetric encryption, and hashing
Three different cryptographic tools guarantee three different things. Confusing them is the most common source of false confidence.
People often say “it is encrypted” as if that settles a security question. It does not, because encryption is not one thing. This lesson covers the three building blocks behind almost every claim of digital protection: symmetric encryption, asymmetric encryption, and hashing. Each guarantees something different, and knowing which one is in play tells you what is actually being protected.
Symmetric encryption: one shared key
Cloudflare’s Learning Center describes symmetric encryption simply: “there is only one key, and all communicating parties use the same (secret) key for both encryption and decryption.” The Advanced Encryption Standard (AES) is the standard example today, having replaced the older Data Encryption Standard (DES) after DES’s short key length made it breakable by brute force. Symmetric encryption is fast and is what actually scrambles the bulk of your data, whether that is a file on disk or the body of a web page loaded over HTTPS. Its central problem is distribution: both sides need the same secret key, and getting that key to the other party without anyone else seeing it is exactly the problem asymmetric encryption solves.
Asymmetric encryption: two keys that work as a pair
In asymmetric, or public-key, encryption there are two mathematically linked keys: “one key is used for encryption, and a different key is used for decryption,” per Cloudflare. The encryption key can be published to anyone — hence “public key” — while the matching decryption key stays private. Data locked with the public key can only be unlocked with the private key. This is what lets two people who have never met agree on a shared secret over an open network, which is exactly what happens at the start of every HTTPS connection (the next lesson covers this handshake in detail). RSA and elliptic-curve cryptography are the common algorithms behind it today.
Hashing: a fingerprint, not a lock
A hash function is neither of the above: it does not lock anything, and there is no key to unlock it with. NIST defines it as a function that “maps a bit string of arbitrary length to a fixed-length bit string” — in plain terms, it turns any file or message into a short, fixed-size fingerprint. NIST specifies the properties an approved hash function must have: it must be computationally infeasible to find an input that produces a given output (one-way), and infeasible to find two different inputs that produce the same output (collision resistance). This is why hashing checks integrity — did this file change? — and protects stored passwords: a service can check a password against its stored hash without ever keeping the actual password. Older hash functions such as MD5 and SHA-1 are no longer considered safe against a determined attacker, which is why modern systems use the SHA-2 or SHA-3 families instead.
What each one actually guarantees
| Tool | What it guarantees | What it does not guarantee |
|---|---|---|
| Symmetric encryption | Confidentiality, if the shared key stays secret | A safe way to exchange that key in the first place |
| Asymmetric encryption | A way to exchange a secret, and to verify identity (see the next lesson on signatures) | Speed; it is far slower than symmetric encryption for large amounts of data |
| Hashing | Integrity: proof that data was not altered, and a way to check secrets without storing them | Confidentiality; a hash is not designed to be reversed, but it is not designed to hide the size or presence of data either |
How they combine in practice
Almost nothing uses only one of these. A typical secure connection uses asymmetric encryption briefly, to agree on a shared secret, then switches to fast symmetric encryption for the actual data, while hashing runs throughout to make sure nothing sent was altered along the way. Recognising these three roles is what makes the rest of this course — signatures, certificates, TLS, and end-to-end encryption — make sense as combinations of the same small set of tools rather than as separate magic.
Key takeaways
- Symmetric encryption uses one shared key for both encryption and decryption; it is fast but requires a way to share the key safely.
- Asymmetric encryption uses a public key and a private key as a pair, solving the key-distribution problem symmetric encryption has.
- Hashing produces a fixed-size fingerprint of data; it protects integrity and stored secrets, not confidentiality — there is no key to unlock a hash.
- Real systems combine all three: asymmetric encryption to agree on a secret, symmetric encryption for speed, hashing to catch tampering.
- Older algorithms (DES, MD5, SHA-1) have known weaknesses; AES and the SHA-2/SHA-3 families are the current standards.
Check yourself
1. What is the defining feature of symmetric encryption?
- It uses a public key and a private key
- It uses one shared secret key for both encryption and decryption — Right.
- It cannot be used for large amounts of data
- It never requires a key at all
Symmetric encryption relies on a single shared key that both parties already have; the challenge is distributing that key safely.
2. What problem does asymmetric encryption solve that symmetric encryption cannot solve on its own?
- Making encryption faster
- Letting two parties agree on a shared secret without meeting first — Right.
- Making passwords easier to remember
- Preventing data from ever being deleted
Public-key cryptography lets a public key be shared openly while only the matching private key can decrypt, enabling secure key exchange over an open network.
3. Why can a hash function not be used to keep a message secret?
- Hashes are always too short to hold a message
- A hash is one-way by design; there is no key to reverse it back to the original data — Right.
- Hash functions are illegal to use for encryption
- Hashes only work on images, not text
Hash functions are built so that recovering the original input from the output is computationally infeasible — that property (one-wayness) makes them useful for integrity checks and password storage, not for confidentiality.
4. Which pair of algorithms are considered outdated because of known weaknesses?
- AES and RSA
- DES and MD5 — Right.
- SHA-2 and elliptic-curve cryptography
- TLS and HTTPS
DES’s short key length and MD5’s collision weaknesses mean modern systems use AES and the SHA-2/SHA-3 families instead.
Do it with FireAI
Put this lesson into practice on your own Mac.
Sources
- Cloudflare Learning Center: What is encryption?
- NIST Computer Security Resource Center Glossary: hash function
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.