Web Security & OWASP (50 Qs)•Part 3: Authentication, Authorization & Cryptographic Standards (26 - 35)
Symmetric vs. Asymmetric Encryption: AES-256-GCM (AEAD) vs. RSA-4096 vs. ECC Curve25519.
Symmetric vs. Asymmetric Cryptography
Encryption transforms plaintext into ciphertext to guarantee confidentiality. Modern cryptography standardizes on specific algorithms for data at rest versus key exchange.
ini
1. Symmetric Encryption (Same Shared Secret):
[ Plaintext ] ---> [ AES-256-GCM (Key K) ] ---> [ Ciphertext + Auth Tag ]
Extremely fast; handles bulk data at rest (hard drives, DB fields, backups).
2. Asymmetric Encryption (Public / Private Key Pair):
[ Plaintext ] ---> [ Public Key ] ---> [ Ciphertext ] ---> [ Private Key ] ---> [ Plaintext ]
Computationally heavier; used for identity, digital signatures, and TLS handshakes.
Algorithm Standards Matrix
| Algorithm | Key Type | Use Case & Strengths | Performance |
|---|---|---|---|
| AES-256-GCM | Symmetric (256-bit) | Industry Standard for Data at Rest. AEAD (Authenticated Encryption with Associated Data) guarantees both confidentiality AND integrity. | Hardware accelerated (AES-NI instructions on modern CPUs). |
| RSA-4096 | Asymmetric (4096-bit) | Legacy PKI, TLS certificates. Requires large keys for modern security margins. | Slow key generation; high CPU overhead. |
| ECC (Ed25519 / Curve25519) | Asymmetric (256-bit) | Modern standard. Provides equivalent security to RSA-3072 with tiny 256-bit keys. Used in SSH keys and Signal protocol. | Ultra-fast signatures and low bandwidth overhead. |