Paper 3 · Unit 17. Symmetric and asymmetric encryption, TLS, digital certificates and signatures.
1. Encryption
Encryption turns plaintext into ciphertext using an algorithm and a key, so intercepted data cannot be understood.
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared secret key encrypts and decrypts | A public key and a matching private key |
| Problem | The key must be distributed securely | Slower; needs more processing |
| Use | Encrypting large amounts of data (e.g. after a TLS handshake) | Exchanging keys, digital signatures |
To send a confidential message, encrypt with the receiver’s public key; only the receiver’s private key can decrypt it. Quantum cryptography uses the properties of photons to distribute keys: any eavesdropping changes the photons and is detected. It needs special hardware and has limited range.
Try it: symmetric encryption with a shared key
A simple shift cipher: the same key encrypts and decrypts, which is the idea behind symmetric encryption (real systems such as AES are far stronger).
2. SSL and TLS
SSL/TLS secures communication between a client and a server (e.g. HTTPS).
- The client connects and requests a secure session.
- The server sends its digital certificate containing its public key.
- The client checks the certificate is valid and issued by a trusted Certificate Authority.
- A symmetric session key is agreed, using the server’s public key to protect it.
- All further data is encrypted with the session key.
Uses: online banking, shopping, email and any login page.
3. Digital certificates and signatures
A digital certificate is issued by a Certificate Authority (CA) and links a public key to its owner’s identity; it includes the owner’s name, public key, expiry date and the CA’s digital signature.
A digital signature proves who sent a message and that it has not been altered:
- The sender hashes the message to get a digest.
- The digest is encrypted with the sender’s private key: this is the signature.
- The receiver decrypts the signature with the sender’s public key and hashes the received message.
- If the two digests match, the message is authentic and unchanged.
4. Examiner tips
- Say whose key is used: receiver’s public key to encrypt; sender’s private key to sign.
- Signatures give authentication and integrity, not confidentiality.
- TLS handshake: certificate, validation, session key, symmetric encryption.
- A CA is a trusted third party that verifies identities.
5. Practice questions
Practice: answer and check instantly
Type a short answer, then press Check or Enter.
Show answer
Symmetric encryption.
Show answer
Ali’s public key.
Show answer
The sender’s private key.
Show answer
Certificate Authority.
Show answer
Ciphertext.
Show answer
TLS (formerly SSL).
Show answer
A message digest.
Show answer
Quantum cryptography.
Exam-style questions
9. Describe how a digital signature is created and checked. [5]
Show mark guide
The message is hashed to produce a digest [1] · the digest is encrypted with the sender’s private key [1] · the receiver decrypts it with the sender’s public key [1] · the receiver hashes the received message [1] · if the digests match, the sender is authentic and the message unchanged [1].
10. Explain why asymmetric encryption is used to exchange a symmetric key. [3]
Show mark guide
Symmetric keys must be shared securely [1] · the key can be encrypted with the receiver’s public key so only their private key can decrypt it [1] · symmetric encryption is then used for the data because it is faster [1].
6. Topic test: predict your grade
Topic test: predict your grade
15 questions, about 10 minutes. Answer them all, then press Mark my test.
Frequently asked questions
How does a digital signature work?
The sender hashes the message and encrypts the digest with their private key. The receiver decrypts it with the sender’s public key and compares it with their own hash of the message.
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared secret key. Asymmetric encryption uses a public key and a matching private key, which solves the problem of sharing the key securely.
What happens in a TLS handshake?
The server sends its digital certificate, the client checks it with a trusted certificate authority, a symmetric session key is agreed, and all further data is encrypted with that key.