Why is hybrid encryption more effective than other encryption scheme?

Question

Currently I am learning about Hybrid Encryption but I was not able to find any good study material.

Below is my understanding:

One of the reason why we use Hybrid Encryption because public-key cryptosystems often rely on complicated mathematical computations and are thus generally much more inefficient than comparable symmetric-key cryptosystems. A hybrid cryptosystem is one which combines the convenience of a public-key cryptosystem with the efficiency of a symmetric-key cryptosystem.

Steps of Hybrid Encryption:

To encrypt a message addressed to Alice in a hybrid cryptosystem, Bob does the following:

• Obtains Alice's public key.
• Generates a fresh symmetric key for the data encapsulation scheme.
• Encrypts the message under the data encapsulation scheme, using the symmetric key just generated.
• Encrypt the symmetric key under the key encapsulation scheme, using Alice's public key.
• Send both of these encryptions to Alice.

To decrypt this hybrid ciphertext, Alice does the following:

• uses her private key to decrypt the symmetric key contained in the key encapsulation segment.
• uses this symmetric key to decrypt the message contained in the data encapsulation segment.

I am pretty much understood how Hybrid Encryption works but I don't see how this is better than Public Key Cryptography.

Question :- Why is Hybrid Encryption superior?

1. It is doing an extra work for generating a symmetric key by using Alice's public key. This will also involve complex mathematical computation.
2. Along with sending data here it also needs to key along.
3. Alice also needs to first decrypt the symmetric key and then decrypt the message. It almost seems like a double work.

I found some answers here but still it seems incomplete link1 and link2

Answer 1

Alice also needs to first decrypt the symmetric key and then decrypt the message. It almost seems like a double work.

Encrypting a short plaintext (i.e. the symmetric key) requires only one asymmetric (e.g. RSA) operation, while encrypting a longer message would in theory require many RSA operations.

Suppose we want to encrypt a 1 MiB message. Using 2048-bit RSA-OAEP exclusively (i.e. without hybrid encryption) would require over 5500 RSA encrypt operations (leaving aside for now the question of mode of operation), all of which are expensive in terms of performance. Using hybrid encryption, we can perform a single expensive RSA encrypt operation on a symmetric key, and do all of the remaining work using fast symmetric encryption like AES-GCM.

Along with sending data here it also needs to [send the] key along.

You're right about this. Hybrid encryption does make the ciphertext longer in cases where the messages are very short. However, 2048-bit RSA-OAEP (for example) operates on plaintexts of at most 190 bytes, so the threshold at which hybrid encryption becomes more efficient is fairly low.

Answer 2

In addition to the other answer.

The "Steps of Hybrid Encryption" in the question really are steps of one form of hybrid encryption, built on top of asymmetric encryption.

There are other forms of hybrid encryption (at least for the meaning of that in protocols), including some

• resistant to passive eavesdropping (attacks where the adversary can't send or modify any message) including if private key(s) have leaked; the most primitive form of that arguably being Diffie-Hellman key exchange followed by use of that symmetric key with symmetric encryption (which is invulnerable to leak of private keys, since there is none!);
• with forward secrecy, that is resistance (including to active attacks) should private key(s) leak, assuming the leak is after the interception; combining the aforementioned Diffie-Hellman key exchange with RSA signature (into DHE-RSA or ECDHE-RSA) is one of several ways to reach that goal (as well as the previous, weakest one).

These properties, offered by some modern TLS cryptosuites, leave the cryptosystem vulnerable only to active attacks with contemporaneous knowledge of the private key (which is hard to mount), or compromise of one of the endpoint.

These are important potential superiorities of hybrid encryption, relevant to the question's "Why is Hybrid Encryption superior?", even though it does not apply to the breed considered in the question.