What must stay in working memory
- For confidentiality to one recipient, encrypt or encapsulate with that recipient's public key; only the recipient's private key can recover the secret.
- Symmetric keys must be delivered and stored secretly by every participant that uses them.
- Public keys may be distributed openly, but their binding to an identity still needs authentication such as a validated certificate.
Concrete examples
- Full-disk encryption uses a fast symmetric cipher.
- A sender uses a recipient's authenticated public key to protect a small session secret.
Decision rules you’ll retrieve
Match the primitive to the workload
Use symmetric encryption for high-volume data once a secret exists; use asymmetric operations for identity-bound key establishment or small values when no shared secret exists yet.
Retrieval cue: Compare symmetric and asymmetric cryptography on speed, key relationship, and the key-distribution problem each creates or solves.
Reason about key distribution and scale
Count who must know each secret and how identity is authenticated: pairwise symmetric secrets multiply as participants grow; public keys scale distribution but still require trusted identity binding and private-key protection.
Retrieval cue: Explain why public keys may travel openly while symmetric and private keys must remain secret, and why certificates still matter.
Use the correct key for confidentiality
To send confidential data to a public-key recipient, use the recipient's authenticated public key for protection and let only the recipient use the corresponding private key for recovery; symmetric peers use the same shared secret.
Retrieval cue: For confidentiality from Alice to Bob, state whose public key protects the secret and whose private key recovers it.