Cryptography Explained: Symmetric, Asymmetric, Hashing and Where Each Is Used

Cryptography is the practice of protecting information using mathematics so that only intended parties can read it or trust it. For a security team, the goal is not to design algorithms — the standard ones are strong — but to understand the building blocks well enough to use them correctly and spot when they are being misused.

What cryptography gives you

Cryptography delivers three guarantees that the rest of security leans on: confidentiality (encryption keeps data secret from anyone without the key), integrity (hashing and signatures reveal whether data was altered), and authenticity (signatures prove who produced something, and that they cannot plausibly deny it). HTTPS, VPNs, disk encryption, password storage, software signing and secure messaging are all applications of these same few primitives.

Symmetric encryption: one shared key

Symmetric encryption uses a single secret key to both encrypt and decrypt. The modern standard is AES (the Advanced Encryption Standard), typically in an authenticated mode such as AES-GCM that protects integrity as well as secrecy. Its strength is speed: it is efficient enough to encrypt large volumes of data, which is why it is used for bulk work — encrypting files, full disks, databases and the actual payload of a secure network connection. Its weakness is key distribution: everyone who needs to read the data needs the same key, and getting that key to them securely is its own problem. If you want to see authenticated symmetric encryption in action, our AES-GCM lab walks through it.

Asymmetric encryption: a key pair

Asymmetric (public-key) encryption uses a mathematically linked pair of keys: a public key that can be shared freely and a private key kept secret. Data encrypted with one is decrypted only with the other. The common algorithms are RSA and elliptic-curve cryptography (ECC), with ECC giving equivalent strength at much smaller key sizes. Asymmetric cryptography is slower than symmetric, so it is not used to bulk-encrypt data. Instead it solves the two problems symmetric cannot: it lets parties exchange a key securely without a pre-shared secret, and it enables digital signatures. In short, asymmetric cryptography is how trust is established; symmetric is how data is then protected.

Hashing: a one-way fingerprint (not encryption)

Hashing is frequently confused with encryption, but it is a different tool. A hash function takes any input and produces a fixed-size fingerprint, and it is one-way: you cannot reverse a hash back to the original, and there is no key involved. SHA-256, part of the SHA-2 family (with SHA-3 as a newer alternative), is a common general-purpose choice. Hashing is used to check integrity (compare the hash of a file now against a known-good hash), as a component inside digital signatures, and to store passwords — you keep the hash, never the password, and compare hashes at login. For passwords specifically, use a deliberately slow, salted password-hashing function, not a plain fast hash, so that guessing is expensive. You can experiment with these in the hashing lab.

Digital signatures: proving origin and integrity

A digital signature combines the previous two ideas. To sign, you hash the data and then encrypt that hash with your private key; anyone with your public key can verify it by hashing the data themselves and checking it against the decrypted signature. If it matches, they know the data was not altered and that it came from the holder of the private key. Signatures are what make software updates, certificates and signed documents trustworthy.

Key exchange and the TLS handshake

Real systems combine all three primitives, and the TLS handshake behind HTTPS is the clearest example. At a high level: when your browser connects to a site, the two sides use asymmetric cryptography and a key-exchange algorithm to authenticate the server (through its certificate) and agree on a shared secret without ever sending that secret in the clear. They derive a symmetric session key from it and then switch to fast symmetric encryption, such as AES, for the rest of the conversation. This hybrid design gets the trust and key-distribution benefits of asymmetric cryptography to set up the session and the speed of symmetric cryptography to carry the data. Our TLS handshake lab steps through the exchange.

Key management is the hard part

Here is the practical truth security teams learn the hard way: the algorithms are rarely the weak point — key management is. Keys have to be generated with good randomness, stored somewhere an attacker cannot reach (ideally hardware-backed), distributed only to the right parties, rotated on a schedule, and retired safely at end of life. A leaked private key undoes every guarantee the mathematics provides, no matter how strong the cipher. Most real-world cryptographic failures are key-handling failures — a secret in a repository, a key that was never rotated, a certificate that expired unnoticed. Planning rotation deliberately with something like a key rotation planner is more valuable than any debate over algorithms.

A note on post-quantum cryptography

Looking ahead, post-quantum cryptography (PQC) is worth understanding at a high level. A sufficiently large quantum computer would be able to break today's widely used asymmetric algorithms (RSA and ECC); symmetric algorithms like AES and hashes like SHA-256 are far less affected. NIST has standardized the first set of quantum-resistant algorithms for organizations to begin adopting. You do not need to rip anything out today, but you should start now: inventory where you depend on public-key cryptography, favour crypto-agile designs that can swap algorithms without re-architecting, and track migration guidance. The reason not to wait is the "harvest now, decrypt later" risk — encrypted data captured today could be stored and decrypted once quantum computers mature.

The takeaway

Three building blocks, each with a job: symmetric encryption for fast bulk secrecy, asymmetric for establishing trust and exchanging keys, and hashing for one-way integrity. Real systems weave them together, as the TLS handshake shows. Use the standard, well-vetted algorithms, never invent your own, and put your energy where the real risk lives — in managing keys and planning for a post-quantum future.

Frequently asked questions

What is cryptography in cyber security? The use of mathematics to protect information so only intended parties can read, verify or trust it — delivering confidentiality, integrity and authenticity. It underpins HTTPS, VPNs, password storage and software signing.

Symmetric versus asymmetric? Symmetric uses one shared key, is fast, and is used for bulk data (AES). Asymmetric uses a public/private key pair, is slower, and is used to establish trust and exchange keys (RSA, ECC). Real systems use both.

Is hashing encryption? No. Hashing is a one-way fingerprint with no key and cannot be reversed; it is used for integrity, signatures and password storage. SHA-256 is a common hash.

How does a TLS handshake use cryptography? It uses asymmetric cryptography and key exchange to authenticate the server and agree a shared secret, then switches to fast symmetric encryption for the session.

What about post-quantum cryptography? A future quantum computer would break RSA and ECC; AES and SHA-256 are far less affected. NIST has standardized quantum-resistant algorithms — start inventorying public-key usage and favour crypto-agile designs now.