Sunday, November 13, 2016

Why does PGP use both symmetric and asymmetric key cryptography?

When I first learned about PGP, I was confused as to how using both encryption methods added security. In PGP, the public keys are exchanged between two parties to encrypt a session key used to encrypt data instead of encrypting the actual data. So when the receiver gets the encrypted content, they will use their private key to decrypt the encrypted session key which can then be used to decrypt the message.

This seemed like an indirect approach to encrypting the message that only added time, not more security. Turns out, the reason both methods are primarily because the current asymmetric cryptosystem, RSA, is a very slow algorithm.

"RSA is a relatively slow algorithm, and because of this it is less commonly used to directly encrypt user data. More often, RSA passes encrypted shared keys for symmetric key cryptography which in turn can perform bulk encryption-decryption operations at much higher speed." (Wikipedia)

No comments:

Post a Comment