Security Fundamentals Practice Question 5: Symmetric Asymmetric TLS
Security Fundamentals · Test 1 · question 5 of 10
Asymmetric (public-key) cryptography solves the problem of agreeing on a secret with a server you have never met. Yet after a TLS connection is established, the web page itself is encrypted with a symmetric cipher such as AES. Why does TLS work this way?
Show answer and explanation
Answer:
Symmetric and asymmetric cryptography solve different problems:
- Symmetric crypto (AES, ChaCha20) uses one shared key. It is very fast, but both parties need the same secret first. - Asymmetric crypto (RSA, ECDSA, Diffie-Hellman) uses key pairs. It lets strangers authenticate each other and agree on a secret over an open network, but it is much more computationally expensive.
TLS combines the two, which is the standard hybrid approach (A). RFC 8446 describes TLS 1.3 as a handshake protocol that authenticates the parties and establishes shared keying material, and a record protocol that uses those traffic keys to protect everything sent afterwards with the negotiated symmetric cipher.
- B is wrong because the two kinds of algorithm are not ranked by "strength", and the asymmetric step is not just a certificate check. It is how the symmetric keys are agreed in the first place. - C is wrong because the negotiated keys protect both directions of the connection. - D is wrong because the client does take part in asymmetric operations: in TLS 1.3 it generates an ephemeral (EC)DHE key share, and with mutual TLS it also signs with its own private key.
Reference: RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3