Phase 3: Authentication & Security

Symmetric (AES) vs asymmetric (RSA) encryption

Advanced ~3 min read
Think of it this way A friendly analogy. Read this if the technical version feels dense. Show Hide

Imagine you and your best friend have a super secret diary you both want to write in, but you don't want anyone else to ever read your secrets. You get a special padlock for it, and here's the cool part: you both have the exact same key to this padlock. You can each open it, write a secret, and lock it back up whenever you want. This is super fast and easy for both of you to use, like a speedy secret-sharing club! Computers use this exact idea, called "symmetric encryption" or "Advanced Encryption Standard" (AES), when they need to send lots and lots of secret messages very quickly, like when you're watching a movie online or sending game data. The trick, though, is how you first gave your friend that secret key. You had to hand it to them safely, right? What if someone sneaky saw you pass it over and copied it? Then your secrets wouldn't be safe anymore!

That's where a different kind of lock comes in. Imagine your teacher has a special, super-secure mailbox on their desk for secret notes. This mailbox has two unique parts. One part is like a slot everyone can see and use; it's called the "public lock." Anyone can put a note into this mailbox through the public lock. But only your teacher has the actual, secret key to open the mailbox and take the notes out. That secret key is called the "private lock." You don't need your teacher's secret key to send them a note, and they don't need your key to read it. You just need to know where their special public mailbox is. This "two-lock" system is called "asymmetric encryption" and is often known as RSA.

This two-lock system is a bit slower than the fast diary padlock, because it takes more steps to manage those two separate locks. However, it's incredibly useful for making sure the very first secret message between two computers is super safe. Think of it like this: your teacher’s secure mailbox (asymmetric) is perfect for you to secretly send your friend the first copy of the shared diary key. Once your friend safely has that key, you can both go back to using the super fast diary padlock (symmetric) for all your daily secrets, knowing the key was delivered without anyone ever seeing it.

So, when you're building secure things on the internet, you often use both types of locks together. The slow, super-secret two-lock method helps you safely share the secret key for the much faster, everyday padlock method. This means you can keep lots of data safe and send it quickly, because the most important secret – the key itself – was shared in the most secure way possible.

As a backend developer, understanding symmetric (AES) and asymmetric (RSA) encryption is crucial for securing data in transit and at rest. The fundamental difference lies in key management. Symmetric encryption, exemplified by AES (Advanced Encryption Standard), uses a single, shared secret key for both encrypting and decrypting data. It's incredibly fast and efficient, making it ideal for encrypting large volumes of data, such as database fields, file storage, or the bulk of data exchanged in a long-lived secure session. The challenge with symmetric encryption is securely exchanging this shared secret key between parties without it being intercepted.

Asymmetric encryption, commonly using RSA (Rivest–Shamir–Adleman), employs a pair of mathematically linked keys: a public key and a private key. Data encrypted with the public key can only be decrypted by its corresponding private key, and vice-versa. The public key can be freely distributed, while the private key must be kept secret by its owner. While significantly slower and more computationally intensive than symmetric encryption, asymmetric encryption excels at secure key exchange and digital signatures. It's perfect for initial handshakes where two parties need to establish a secure communication channel, allowing them to safely exchange a symmetric key for subsequent, faster data encryption.

In practice, modern secure communication protocols like TLS/SSL (which powers HTTPS) leverage a hybrid approach, combining the strengths of both. During the initial TLS handshake, asymmetric encryption (RSA or similar) is used to securely exchange a temporary symmetric session key. Once this session key is established, all subsequent data transfer is encrypted using the much faster symmetric encryption (AES). This strategy provides both the robust security of asymmetric key exchange and the high performance needed for continuous data flow, forming the backbone of secure backend operations from API communication to microservice interactions.

Key Takeaways

  • Symmetric (AES) uses one key for encryption/decryption; it's fast and ideal for bulk data encryption.
  • Asymmetric (RSA) uses a public/private key pair; it's slower but essential for secure key exchange and digital signatures.
  • Backend systems (e.g., HTTPS/TLS) often combine both: asymmetric for initial key exchange, then symmetric for high-performance data encryption.
  • Key management is a primary differentiator: symmetric requires secure pre-sharing, asymmetric distributes public keys.

Code Example

python
import os
from cryptography.fernet import Fernet # High-level symmetric encryption for Python

# --- 1. Generate a symmetric key (In a real backend, this key would be securely exchanged/managed) ---
key = Fernet.generate_key()
f = Fernet(key)
print(f"Generated symmetric key: {key.decode()[:10]}...")

# --- 2. Encrypt some data ---
original_data = b"My backend API secret payload."
encrypted_data = f.encrypt(original_data)
print(f"Encrypted data: {encrypted_data.decode()[:20]}...")

# --- 3. Decrypt the data using the same symmetric key ---
decrypted_data = f.decrypt(encrypted_data)
print(f"Decrypted data: {decrypted_data.decode()}")

How this code works

This code demonstrates symmetric encryption, a core concept where the same secret key is used for both encrypting and decrypting data. Its job in the lesson is to illustrate this "single key" principle, setting the stage for understanding algorithms like AES.

The process starts by importing Fernet from the cryptography library, which provides a high-level symmetric encryption implementation. Fernet.generate_key() creates a brand-new, random secret key, which is then used to initialize a Fernet object (f). This f instance is then used to encrypt the original_data into encrypted_data with f.encrypt(original_data). To reverse this, f.decrypt(encrypted_data) uses the exact same key to retrieve the original_data. A subtle point often tripping up beginners is that original_data is defined as a bytes literal (due to the b prefix), and decode() is specifically called when printing to convert the resulting bytes back into a human-readable string.

Resources

Related Articles

Hand-picked reads to go deeper on encryption & hashing.

Back to Backend Developer Roadmap