Quick disclaimer, I am pretty new to cryptography. I only understand the basics of asymmetric and symmetric encryption. In particular, RSA and AES.

I have a project where my service is receiving an encrypted SAML payload. As per the project description: a Public key 2048 was used to encrypt the payload and a Private key is to be used for the decryption of the same. First thing I get from this is we are talking about an asymmetric algorithm. However, the decryption algorithm to be used is RSA_WITH_AES256_CBC_SHA256. When I asked what algorithm was used to encrypt the payload, I was told AES256_CBC_SHA256. Now, that would be a symmetric algorithm.

As already stated, I am really new in this field. Therefore, I am not sure if I am being ignorant or if something does not add up?

  • 1
    $\begingroup$ I have added the tag hybrid-encryption, which is the meat of the question. In a nutshell, there is symmetric cryptography for the confidentiality and integrity of applicative data, using a per-message random secret key, and asymmetric cryptography to transfer the key encrypted using RSA. Asymmetric crypto could also sign the data or the key, giving proof of origin. $\endgroup$
    – fgrieu
    Feb 16 at 6:45
  • $\begingroup$ That makes sense, thank you @fgrieu! $\endgroup$ Feb 16 at 21:14
  • $\begingroup$ ciphersuite.info/cs/TLS_RSA_WITH_AES_256_CBC_SHA256 $\endgroup$
    – kelalaka
    Feb 17 at 22:45

1 Answer 1


This is about a hybrid cryptosystem where a key encapsulation mechanism is combined with a symmetric cipher. The field is expanding, for instance because of the advent of PQC algorithms. Several ways of performing this kind of hybrid encryption can be found in RFC 9180: Hybrid Public Key Encryption

Key establishment can be achieved in several ways:

  1. Key wrapping can be used where a cipher is directly encrypted using a public key and decrypted using the correspoding private key of the receiver. Examples are RSA-PKCS#1 and RSA-OAEP.
  2. Key encapsulation is a bit of a weird term as it is usually combined with a key derivation function to establish the actual symmetric key(s). Examples are RSA-KEM and CRYSTALS-Kyber.
  3. Key agreement where ephemeral-static Diffie-Hellman is used. EC and ECDH are examples, sometimes with an "e" attached to the name to indicate that an ephmemeral, message-specific key pair is generated by the sender.

Hybrid cryptography is also commonly used by protocols for transport security such as TLS and SSH.

For currently used TLS the asymmetric part is could be performed by asymmetric encryption for both authentication and key establishment or by using ephemeral Diffie-Hellman for key agreement followed by server authentication using a signature algorithm (client authentication always uses a signature algorithm). The PKI here is called PKIX as it uses a hierarchical PKI build upon the ITU-T X-specifications (X.509v3 certificates and CRL's, for instance).

SSH has similar properties but uses PGP for authentication instead.

RSA_WITH_AES256_CBC_SHA256 is a well known, older TLS 1.2 compatible cipher suite name that uses RSA encryption for both key establishment and authentication. It uses a PRF (or rather a KDF called by the more generic PRF name) to establish the keys used for message encryption (AES-CBC) and authentication (HMAC-SHA-256). This is performed after the master secret is transported using the RSA encryption, so there is no direct establishment of these session keys - there is a little bit more to it.

For SAML it may also be that AES-256 and RSA-OAEP are used as parameters for XML-enc which is a well defined XML-encryption scheme by W3C. It can be used in a sign-and-encrypt scheme when combined with XML-digsig.

Beware that hybrid cryptography can have different meanings specific to context:

  1. asymmetric + symmetric may not just include key establishment + encryption but signature creation (hash + asymmetric algorithm). Note that hashes usually have a common construction as symmetric ciphers and both parties need to perform the same calculation.
  2. "classical" algorithms combined with Post Quantum algorithms (PQC).

As these uses do not conflict with each other we may be heading towards hybrid-hybrid cryptography. I wish they could have thought of a different term for #2.

Any other constructions where two or more schemes are used together could also be considered "hybrid".

Note that nobody should try and implement these protocols when confronted with them; the first step should be to find & use existing projects and possibly help them if they are broken or if functionality or documentation is missing. Security reviews are uncommon and generally very much appreciated.

  • $\begingroup$ I don't see anything about sign-then-encrypt at your auth0 link, and xmlenc is definitely hybrid=asym+sym encryption only; signature is a separate though similar standard: xmldsig. Also X.509 is not from ANSI; it is from ITU-T, the organization formerly known as CCITT. $\endgroup$ Feb 20 at 0:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.