Last updated:
CISSP decision trap
What is the difference between symmetric and asymmetric encryption, and how does CISSP test it?
Direct answer
Symmetric encryption uses one secret key, shared by everyone in the exchange, to encrypt and decrypt. Asymmetric encryption uses a key pair: a public key anyone may hold and a private key only its owner holds. Symmetric is fast and suits bulk data, but the shared key has to reach each party safely. Asymmetric removes the need to share a secret in advance and makes digital signatures possible, but it is slower, so protocols such as TLS use asymmetric keys to set up a symmetric session key.
Symmetric and asymmetric encryption side by side
| Question | Symmetric | Asymmetric |
|---|---|---|
| Keys | One shared secret key | A public key and a private key for each party |
| Speed and typical use | Fast: bulk data, disks, backups, session traffic | Slower: key setup, signatures, small data |
| Hard part | Getting the key to each party safely | Trusting that a public key belongs to its owner (PKI) |
| Keys for n people talking pairwise | n(n−1)/2 shared keys | 2n keys: one pair each |
| Services | Secrecy; add a keyed checksum (MAC) to detect tampering and check origin | Secrecy, key setup, and signatures that show who signed and that nothing changed |
| Examples | AES; retired: DES and Triple DES | RSA; elliptic curve (ECDSA, EdDSA, ECDH); DH key agreement; ML-KEM and ML-DSA for the quantum era |
| About 128-bit strength (NIST) | AES-128 | RSA 3072-bit, or elliptic curve 256-bit |
Encrypting and signing one file
A finance manager must send a large, confidential payroll file to the company's bank every month, and the bank must be able to show that each file came from her and was not changed on the way. Both sides already have certificates from a trusted authority.
No single key does all of this. The file is encrypted with a fresh symmetric key, because symmetric encryption is fast enough for bulk data, and that key is protected with the bank's public key so only the bank can recover it. She signs the file with her own private key, and the bank checks the signature with her public key from her certificate: that gives integrity, authentication and support for non-repudiation.
Which key does what
To keep a message secret, encrypt it with the recipient's public key; to sign it, use your own private key.
Confidentiality: anyone can encrypt with the recipient's public key, and only the recipient's private key can decrypt. A digital signature works the other way round: the signer uses their own private key, and anyone with the matching public key can check it.
The exam often tests the reversal. Something done with the sender's private key proves where a message came from; it does not keep the message secret, because everyone holds the sender's public key.
A simple picture: a public key is an open padlock you hand out. Anyone can snap it shut on a box, but only your private key opens it.
On the symmetric side, ciphers come in two kinds: block ciphers such as AES encrypt fixed-size blocks of data, and stream ciphers encrypt data a bit or a byte at a time.
- Send a secret: the recipient's public key encrypts; the recipient's private key decrypts.
- Sign: the sender's private key signs; the sender's public key verifies.
- Symmetric: the same shared key encrypts and decrypts, so everyone holding it can do both.
How many keys you need
Pairwise shared keys grow with the square of the group: n(n−1)/2 symmetric keys against 2n asymmetric keys.
If every pair of people needs its own secret, the count rises fast. Ten people need 45 shared keys, or 20 keys in pairs (one public and one private key each). One hundred people need 4,950 shared keys or 200 keys in pairs, and 500 people need 124,750 shared keys or 1,000.
The count grows with the square of the group size, which is why large organisations use public keys and a PKI, a key distribution centre that hands out session keys, or both.
Which security services each provides
Both can give confidentiality, but only a private-key signature supports non-repudiation.
Symmetric keys give integrity and authentication through a message authentication code or an authenticated encryption mode. But every holder of a shared key could have produced the same result, so a symmetric key cannot show which of them acted.
A digital signature can, because only one party holds the private key. That is why non-repudiation questions point to signatures and certificates; the 2027 CISSP outline lists digital signatures and certificates with non-repudiation and integrity under objective 3.6.
How TLS uses both
TLS uses asymmetric keys to agree a session key and authenticate the server, then a symmetric cipher for the data.
NIST describes protocols such as TLS and VPNs as usually using separate asymmetric keys for key establishment and for authentication. The key-establishment keys are temporary, often used for a single exchange, so a long-term key stolen later cannot unlock earlier sessions. That property is forward secrecy.
The symmetric keys that come out of the exchange then protect the traffic itself, because symmetric encryption is far faster for bulk data.
Is asymmetric encryption more secure?
No. The two solve different problems, and strength comes from the algorithm and the key size.
NIST's key management guidance puts AES-128, RSA with a 3072-bit key and elliptic curve with a 256-bit key at about the same 128-bit security strength. Asymmetric encryption's advantage is key distribution and signatures, not stronger secrecy.
Diffie-Hellman belongs on the asymmetric side, but it is key agreement, not encryption: the two parties end up with a shared secret key and use a symmetric cipher for the data. Under NIST SP 800-131A, Triple DES has been disallowed for encryption since the end of 2023, though it may still decrypt old data, and DES is long retired.
Quantum computing: what NIST now says
NIST is phasing out RSA, elliptic curve and Diffie-Hellman, but it does not expect to move away from its symmetric standards.
NIST's final transition report, approved in October 2026, lists RSA, ECDSA and EdDSA signatures, and RSA and Diffie-Hellman key establishment, as deprecated after 2030 and disallowed after 2035, because a large enough quantum computer running Shor's algorithm could break them. Their replacements include ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures.
For symmetric cryptography, NIST says its standards are significantly less vulnerable and that symmetric algorithms with at least 128 bits of security, AES-128 included, are believed to meet its lowest post-quantum category. NIST's few 112-bit symmetric standards will be disallowed in 2030. NIST also warns that data protected today with quantum-vulnerable key establishment could be recorded now and decrypted later. The 2027 CISSP outline names post-quantum methods in objective 3.6.
Exam-style scenarios
Read for the service the question asks for, then pick the method and the key that give it.
- A company copies large nightly backups to its recovery site and wants them unreadable in transit: symmetric encryption, with the key exchanged or wrapped safely.
- An auditor must be able to prove which manager approved a change: a digital signature with that manager's private key, not a shared key.
- Five hundred staff need private messages between any two of them: public keys and a PKI, not 124,750 shared keys.
Common mistakes
Most wrong answers swap the keys or credit one method with something it cannot do.
- Encrypting a secret with the sender's private key.
- Calling asymmetric encryption more secure instead of more convenient to distribute.
- Treating Diffie-Hellman as an encryption algorithm.
- Counting a hash as encryption: a hash has no key and cannot be reversed; HMAC adds a key for integrity.
- Doubling every key size for quantum: NIST's report keeps AES-128 and replaces the public-key algorithms.
Sources and fact check
Source checked: 2026-11-02
- ISC2 CISSP Certification Exam Outline, effective 15 April 2024 (PDF)
- ISC2 CISSP Certification Exam Outline, effective 15 April 2027 (PDF)
- NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final, October 2026)
- NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management
- NIST SP 800-131A Rev. 2, Transitioning the Use of Cryptographic Algorithms and Key Lengths
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one secret key, shared by everyone in the exchange, to encrypt and decrypt. Asymmetric encryption uses a key pair: a public key anyone may hold and a private key only its owner holds. Symmetric is fast and suits bulk data, but the shared key has to reach each party safely. Asymmetric removes the need to share a secret in advance and makes digital signatures possible, but it is slower, so protocols such as TLS use asymmetric keys to set up a symmetric session key.
Is asymmetric encryption more secure than symmetric?
No. They solve different problems. Strength comes from the algorithm and the key size; NIST puts AES-128 and RSA-3072 at about the same strength.
Which key encrypts a confidential message, and which key signs it?
The recipient's public key encrypts, so only the recipient's private key can decrypt. The signer's own private key signs, and anyone checks the signature with the signer's public key.
Is Diffie-Hellman symmetric or asymmetric?
It is an asymmetric key-agreement method. It produces a shared secret key; it does not encrypt data itself.
Is AES symmetric, and will quantum computers break it?
AES is symmetric at every key size: 128, 192 or 256 bits. NIST says its symmetric standards are significantly less vulnerable to quantum attack and does not expect to replace them; RSA and elliptic curve are the ones being phased out.
