What are the practical limitations of Asymmetric encryption vs Symmetric encryption? [duplicate]

Question

I hear it commonly said that the advantages of Symmetric encryption are speed and no limit to the amount of data that can be symmetrically encrypted.

I also hear it commonly said that the advantages of Asymmetric encryption are security.

But theoretically, if I want to symmetrically encrypt a 1TB file, my algorithm is just going to break the 1TB file into smaller chunks, encrypt them, and spit out the cipher text.

Why couldn't I do the same with Asymmetric encryption? AKA, what are the practical limitations of using Asymmetric encryption for bulk encryption?

Answer 1

The advantage of asymmetric encryption is not security, it is capability. Asymmetric crypto provides completely different capability that you can't get with symmetric crypto. With symmetric encryption, you have to establish a key a priori. With asymmetric crypto, you can establish a key on the fly (granted you have to have trust in the public key, that it belongs to the party you want to interact with). With asymmetric crypto you often have digital signatures, establishing authenticity of data.

You mention the primary advantage of symmetric crypto in your question, speed.

So, to your questions:

Why couldn't I do the same with Asymmetric encryption?

You could. You would first have to define how you are going to encrypt large amounts of plaintext. Do you build a > 1TB modulus? Absolutely not. Do you establish some sort of mode of operation? Sure, but then you have to prove security.

You also will likely want integrity checks like you would get with authenticated encryption or HMAC. How do you do that?

what are the practical limitations of using Asymmetric encryption for bulk encryption?

Speed and the lack of trusted, well studied standards.

Answer 2

No modes of operation have been specified to perform asymmetric encryption of large messages. The main disadvantage if efficiency. Even if the amount of CPU power would be negligible (which it probably isn't) then e.g. using RSA would substantially increase the size of the ciphertext.

There is not really a choice necessary between one or the other. An engineer should choose the right tool for the job; encryption is just one particular use. That often means to use both as asymmetric encryption is necessary for complicated key management schemes and the efficiency of symmetric algorithms are required for any kind of message handling. If both asymmetric and symmetric algorithms are used the system is called a hybrid cryptosystem.