Hybrid encryption: how it really works
You now have two kinds of locks. The symmetric one (one key) is lightning fast and can encrypt an entire movie — but you have to get the key to the other person first. The asymmetric one (two keys) solves that — but can barely encrypt a sentence and is slow. Which do you pick? Neither. You use them together, and that's exactly what every real system does — from the padlock in your browser to your messaging app.
Words you might need
- Hybrid
- A mix. Here: asymmetric encryption for the small part, symmetric encryption for the big part.
- Session key
- A symmetric key you only use once: for this one message, or for this one visit to a website. Thrown away afterwards.
- TLS
- The system behind the padlock and the
https://in your address bar. It uses an asymmetric trick to agree on a session key, then encrypts everything symmetrically after that.
The recipe
- Make a fresh, random symmetric key. Just for this one message.
- Encrypt the message with it (AES). Fast, and as big as you like.
- Encrypt that key — only 32 bytes — with the recipient's public key. That fits well within RSA's 190-byte limit.
- Send both packages together: the big one (message) and the small one (key).
The recipient does the reverse: first open the small package with their private key to get the session key back, then use that to decrypt the big package. Two locks, one letter.
Try it yourself
Everything happens in your browser. Nothing is sent to the server.
- Click The recipient makes a key pair. She puts her public key online; that's all you need.
- Click Encrypt. Look at the three parts and their size.
- Paste the message ten times in a row and encrypt again. The RSA part stays exactly 256 bytes. Only the AES part grows.
- Click Decrypt and follow the two steps the recipient takes.
Where you use this every day
| Where | How |
|---|---|
| The padlock in your browser (TLS) | When opening a site, your browser and the server use an asymmetric trick to agree on a session key — usually with an elliptic curve. Everything that goes back and forth after that is symmetrically encrypted. |
| WhatsApp, Signal | Same principle, with an extra layer: the key changes with every message, so that one leaked key only exposes one message. |
| Belgian healthcare (eHealth) | Doctors send each other encrypted messages using exactly this recipe. The message is first signed and then sealed: the recipient knows who sent it and that no one else could read along. |
Why a new key per message
Say a key ever leaks — a hack, a mistake, a lost laptop. If you used that same key for everything, everything is now exposed, including what you sent years ago. With a fresh key per message, the damage is limited to that one message. This is called forward secrecy: the past stays sealed, even if the present leaks.
This is math: how many keys do you need?
Say 30 students in a class all want to be able to write to each other secretly, using only symmetric keys. Every pair needs its own key. How many pairs are there? 30 × 29 / 2 = 435 keys. With 1000 people: 499,500. With the whole world: impossible. With asymmetric keys, every person only needs one key pair, no matter how many people there are. That's combinatorics: the math of counting how many ways there are to do something. It decides whether an idea works for ten people or for eight billion.