# Which key is which?

## A look at the differences between symmetric and asymmetric keys.

Users new to the world of cryptography often find themselves confused about the appropriate cryptographic key to...

use for various applications. It's actually a relatively straightforward selection process that depends upon the algorithm you're using and the goal(s) you're trying to achieve.

Remember that there are two basic types of cryptographic algorithms – symmetric (private key) and asymmetric (public key) algorithms. Symmetric key algorithms use a single key to secure communications and achieve the goals of confidentiality, integrity and (sometimes) authentication. Asymmetric algorithms provide each user with a pair of keys – a public key and a private key. Users freely distribute their public key while keeping their private key secret. These keypairs are used to achieve all four cryptographic goals: confidentiality, integrity, authentication and non-repudiation. (If you need a refresher on these goals, see the tip Encryption and electronic mail).

An easy way to keep this straight is to remember that the symmetry in a symmetric algorithm results from the fact that both parties are using the same key. Asymmetric algorithms, on the other hand, do not achieve this symmetry – each participant in a communication uses a different key for their portion of the exchange.

Now the big question – which key should you use for a particular application? If you're using a symmetric algorithm, the answer is simple – you use the only key available to you, the secret key. If you're using a public key algorithm, it depends upon the application:

• To protect the confidentiality of a message, encrypt the message with the recipient's public key.
• To read an encrypted message sent to you, decrypt the message with your private key.
• To create a digital signature for a message, encrypt the message digest with your private key.
• To verify the digital signature for a message, decrypt the digital signature with the sender's public key and compare the result to the message digest you compute.

It's as simple as that! Take a few minutes to think through the scenarios and you'll be a master of cryptographic keys in no time!

Mike Chapple, CISSP, currently serves as Chief Information Officer of the Brand Institute, a Miami-based marketing consultancy. He previously worked as an information security researcher for the U.S. National Security Agency. His publishing credits include the TICSA Training Guide from Que Publishing, the CISSP Study Guide from Sybex and the upcoming SANS GSEC Prep Guide from John Wiley. He's also the About.com Guide to Databases.

This was last published in May 2003

## Content

Find more PRO+ content and other member only offers, here.

#### Start the conversation

Send me notifications when other members comment.

## SearchCloudSecurity

• ### How to prepare for a cloud DDoS attack on an enterprise

Suffering a cloud DDoS attack is now more likely than ever. Expert Frank Siemons discusses what enterprises need to know about ...

• ### Ownership of cloud risks gets lost in many cloud computing scenarios

CISOs ensure that cloud services comply with IT security and risk management policies. But who has executive oversight of ...

• ### Cloud incident response: What enterprises need to include in a plan

A cloud incident response plan can be difficult to assemble. Expert Rob Shapland discusses the basics of what to include in a ...

## SearchNetworking

• ### Zero downtime goal of new industry group

Networking analysts discuss if a new zero-downtime initiative will be viable and the best way to unlock the value of the hybrid ...

• ### Cisco refreshes Meraki switches, adds access point for hotel industry

Cisco has released the first Layer 2 Meraki switches with 10 GbE uplinks. The vendor also introduced an access point designed for...

• ### Arista, Brocade intro better spine, leaf switches for the data center

Arista and Brocade have introduced spine and leaf switches. Arista has focused on performance; Brocade has added network ...

## SearchCIO

• ### Renew vs. replace software? CFOs say it depends on business capabilities

CFOs discussed how they decide whether to keep or replace software at the recent MIT Sloan CFO Summit. Cloud looms large in their...

• ### Record-busting online holiday sales and the rise of the omnishopper

Record online holiday sales foretell the arrival of conversational commerce, digital humanism and the omnishopper. Also: AWS goes...

• ### Will AR and VR tech revolutionize digital business management?

In this issue of CIO Decisions, we explore how virtual reality and augmented reality technologies could quickly become integral ...

## SearchConsumerization

• ### Android, Windows tablets from HP take aim at business users

HP released a new line of tablets targeting business users. The HP Pro Slate 8 and Pro Slate 12 run Android and cost \$449 and ...

• ### Microsoft to lay off 18,000, Nokia X moves to Windows Phone

Microsoft will lay off 18,000 people over the next year while the Nokia X line of Android smartphones, which was unveiled earlier...

• ### Microsoft Surface Pro 3 vs. Microsoft Surface Pro 2

Surface Pro 2 and Surface Pro 3 are different enough that Microsoft is keeping both on the market as competing products. Which ...

## SearchEnterpriseDesktop

• ### VMware Identity Manager helps IT provide user access across device types

With Identity Manager, VMware's identity as a service offering, IT admins can deliver a variety of application types across ...

• ### Experts predict the future of Windows 10 and the Creators Update

Three experts share their thoughts on what's next for enterprise desktop admins in 2017, including what to expect from Windows 10...

If admins notice any issues with tasks running on Windows, they can turn to NirSoft's TaskSchedulerView to pinpoint the culprit ...

## SearchCloudComputing

• ### Multicloud computing bliss not yet a reality for all IT shops

Experts predict multicloud computing will be a top enterprise trend in 2017, but some cloud users question whether the touted ...

• ### Perform a PaaS pricing comparison for public cloud

When choosing a platform, enterprises need to focus on features and prices for Azure, Google and AWS. Take a look under the hood ...

• ### Cloud orchestration tools become a must-have for hybrid IT

Some IT shops try to force-fit legacy orchestration tools to cloud -- but that can backfire. Instead, evaluate new orchestration ...

## ComputerWeekly

• ### UKtech50 2016 - The most influential people in UK IT

Computer Weekly has announced the seventh annual UKtech50 – our definitive list of the movers and shakers in the UK IT sector

• ### UKtech50 2016 - The most influential people in UK IT

Computer Weekly has announced the seventh annual UKtech50, our definitive list of the movers and shakers in UK IT – the CIOs, ...

• ### UKtech50 interview: ARM Holdings CEO Simon Segars

The UKtech50 most influential person in UK IT 2016, ARM Holdings CEO Simon Segars, shares his thoughts on the consequences of ...

Close