Cryptography Basics: Symmetric Encryption, Asymmetric Encryption, and Digest Algorithms

Protecting user passwords, encrypting data in transit, signing and verifying signatures: all of these security mechanisms rely on cryptographic algorithms. What is the difference between symmetric and asymmetric encryption? What exactly does a digital signature verify?

Cryptography is the foundation of information security. Understanding these basic concepts is essential for designing secure systems.

Symmetric encryption: one shared key

Encryption and decryption use the same key.

graph LR
    A[明文] -->|加密| B[密钥 K]
    B -->|加密| C[密文]
    C -->|解密| D[密钥 K]
    D -->|解密| E[明文]

Common algorithms

Algorithm	Type	Characteristics
SM4	Block	Chinese commercial cryptography standard
AES	Block	Internationally used, most widespread
DES	Block	Deprecated, key too short
RC4	Stream	Deprecated, insecure

Block modes

/* ECB：相同明文产生相同密文，不安全 */
.mode-ecb { }

/* CBC：最常用，需初始化向量 */
.mode-cbc { }

/* GCM：带认证的加密，推荐 */
.mode-gcm { }

/* CTR：可并行计算，推荐 */
.mode-ctr { }

Use cases

• Encrypted data storage
• Large-volume data transfer
• Fast and efficient

Drawback: key distribution is difficult and requires a secure channel

Asymmetric encryption: public and private keys

Encrypt with the public key, decrypt with the private key (or the reverse).

graph LR
    A[明文] -->|公钥加密| B[公钥]
    B -->|加密| C[密文]
    C -->|私钥解密| D[私钥]
    D -->|解密| E[明文]

Two usage patterns

1. Public key encryption -> private key decryption (encryption)

A 要发消息给 B：
1. A 用 B 的公钥加密
2. 只有 B 的私钥能解密
3. 即使被截获也无法解密

2. Private key signs -> public key verifies (authentication)

A 要证明消息是自己发的：
1. A 用自己的私钥对消息签名
2. 任何人都能用 A 的公钥验证
3. 签名成功说明消息确实来自 A

Common algorithms

Algorithm	Type	Characteristics
SM2	Asymmetric	Chinese national standard, high efficiency
RSA	Asymmetric	Internationally common, long keys
ECC	Asymmetric	Curve-based, shorter keys at equivalent security

Practical approach: hybrid encryption

// 用非对称加密传递对称密钥
async function encryptMessage(message, recipientPublicKey) {
  // 1. 生成随机对称密钥
  const symmetricKey = generateRandomKey();

  // 2. 用对称密钥加密消息
  const encryptedMessage = encryptAES(message, symmetricKey);

  // 3. 用接收者的公钥加密对称密钥
  const encryptedKey = encryptRSA(symmetricKey, recipientPublicKey);

  return { encryptedMessage, encryptedKey };
}

This preserves security (asymmetric encryption for the key) while maintaining efficiency (symmetric encryption for the data).

Digest algorithms: digital fingerprints

Converts data of arbitrary length into a fixed-length “fingerprint”.

// 相同输入 → 相同输出
// 不同输入 → 几乎不可能相同输出
hash('hello')     // 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
hash('hello')     // 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

hash('hello1')    // fe5f80e6a1d7d7c3c1e8e5a1b2c3d4e5f6789012345678901234567890abcd

Characteristics

Property	Description
One-way	Cannot reverse the digest to recover the original data
Collision resistance	Extremely hard to find two different inputs with the same digest
Fixed output	Arbitrary input length, fixed output length

Common algorithms

Algorithm	Output length	Status
SM3	256 bits	Chinese national standard
SHA-256	256 bits	International standard
SHA-1	160 bits	Deprecated
MD5	128 bits	Deprecated

Practical uses

// 1. 密码存储：存摘要，不存明文
const hashedPassword = hashSHA256(userPassword);
database.save(hashedPassword);

// 2. 文件完整性校验
const fileHash = hashFile('document.pdf');
// 对比 hash 值确认文件未被篡改

// 3. 数字签名
const messageDigest = hashSHA256(originalMessage);
const signature = signWithPrivateKey(messageDigest, privateKey);

---

Summary

Type	Use	Speed
Symmetric encryption	Data encryption	Fast
Asymmetric encryption	Key exchange, signatures	Slow
Digest algorithms	Integrity verification	Fastest

Real systems usually combine all three: asymmetric encryption to exchange the symmetric key, symmetric encryption for the actual data, and digests to ensure integrity.

Related reading

• Cryptography lessons learned
• HTTPS vs. HTTP