IGCSE Computer Science 0478: Choosing Symmetric or Asymmetric Encryption

A small accounting firm, BrightBooks, uses encryption in two different situations.

Situation 1: Two accountants who both work in the same office regularly back up files from a shared laptop onto a USB drive. Before doing this, they agreed a single secret password with each other in person, and this same password is used to both encrypt and decrypt the backup files.

Situation 2: BrightBooks emails encrypted invoices to external clients over the internet. Many of these clients are new customers who BrightBooks has never met in person and has no existing secure way of contacting privately.

(a) State which type of encryption, symmetric or asymmetric, is more appropriate for situation 1, and justify your answer with reference to the scenario. [2]

(b) State which type of encryption is more appropriate for situation 2, and justify your answer with reference to the fact that BrightBooks has never met these clients. [2]

(c) Describe the key-distribution weakness of symmetric encryption that makes it unsuitable for situation 2, and explain how asymmetric encryption avoids this weakness. [4]

Part (a): Situation 1. The shared office backup

Symmetric encryption is the more appropriate choice here. The two accountants already work in the same office and were able to agree a single secret password with each other in person, so there is a safe, existing way for them both to possess the same key without ever having to send it over an insecure channel. Symmetric encryption is also generally faster than asymmetric encryption, which suits a task like backing up files regularly.

Part (b): Situation 2. Emailing new, unmet clients

Asymmetric encryption is the more appropriate choice here. Because BrightBooks has never met these clients and has no existing secure way of contacting them privately, there is no safe method of agreeing a single shared secret key in advance. Sending such a key over the internet would risk it being intercepted by an attacker. Asymmetric encryption solves this problem: each client’s public key can be published or shared openly, even over an insecure connection like email, and BrightBooks can use it to encrypt invoices, while only the client’s own private key, which never has to be transmitted anywhere, is able to decrypt them.

Part (c): The key-distribution weakness, and how asymmetric encryption avoids it

Symmetric encryption uses one single key for both encrypting and decrypting data, which means both the sender and the receiver must already possess an identical copy of that key before any secure communication can take place. If that one key has to be sent to a new client over an insecure network such as the internet, it is at risk of being intercepted; anyone who captures it would then be able to decrypt every message ever protected by that key, since the same key does both jobs.

Asymmetric encryption avoids this weakness by using two different, mathematically linked keys instead of one. The public key can be shared completely openly. Published on a website, emailed to anyone, or intercepted without consequence, because on its own it can only be used to encrypt data, not decrypt it. Only the matching private key, which the client generates and keeps secret at all times, is able to decrypt data that was encrypted with that public key, and this private key never has to be sent anywhere at all. This means BrightBooks and a brand-new client can begin communicating securely immediately, without ever needing a prior secure channel to agree a shared secret.

Final answers

(a) Symmetric encryption, the accountants already share a key agreed safely in person.
(b) Asymmetric encryption. There is no safe way to agree a shared key with unmet clients.
(c) Symmetric encryption’s single key must reach both parties, risking interception if sent over the internet; asymmetric encryption avoids this because only the freely shareable public key needs to travel, while the private key needed to decrypt is never transmitted.