With public-key crytography, is private-key crytography still useful?

It seems that, with public-key cryptography, there is no need to use private-key cryptography. But obviously, both public-key cryptography and private-key are taught in cryptography classes. Can anybody let me know when private-key crytography is useful in practice? If so, can it be replaced with public-key cryptography?

Prelude: Generally, I think we should call it "public key cryptography" and "secret key cryptography". You have public / private key pairs where the private key is kept privately, i.e. you have just one holder of the key. With secret key cryptography the key is kept secret but it may still be shared. Another, more common way of describing it is "asymmetric cryptography" and "symmetric cryptography" because with asymmetric cryptography each party has a different key.

Sometimes private keys in an asymmetric cryptosystems are also called secret keys because they are kept secret and because "secret key": $sk$ has a different acronym as "public key": $pk$.

Asymmetric cryptography can be used at many places where symmetric cryptography can be used as well. However, there are definitely also differences in operation on a theoretical level: a public key in a cryptosystem can be used to keep the data confidential, but it cannot be used to provide authentication or integrity of the message. Which means that you have to have two key pairs - one for encryption and one for signature generation.

There are however many operational differences as well when it comes to implementing the $\operatorname{Gen}$, $\operatorname{Enc}$ and $\operatorname{Dec}$ that make up a cryptosystem. $\operatorname{Gen}$ stands for key (pair) generation, $\operatorname{Enc}$ is encryption and $\operatorname{Dec}$ is decryption.

• $\operatorname{Gen}$ will generate a key pair that is much larger for asymmetric systems than for symmetric systems: first of all you get two keys, those keys require at least twice as many bits for the same security level and finally the encoding of these keys will be larger as well;
• $\operatorname{Gen}$ is much slower for asymmetric systems, where symmetric systems only require random number generation, asymmetric systems require that random to build a key pair, often require modular exponentiation;
• $\operatorname{Gen}$ the use of additional mathematical constructs may make asymmetric key pair generation more prone to side channel attacks (many certified products used to exclude key pair generation from the security evaluation)
• $\operatorname{Enc}$ will vastly expand the ciphertext on asymmetric systems, as operations on large numbers usually output large numbers as well, while with symmetric encryption the size of the ciphertext will generally be identical to the plaintext + some overhead;
• $\operatorname{Enc}$ will be much slower on asymmetric systems, as operations on large numbers are much slower than symmetric ciphers, which generally just use binary operations or math on smaller numbers (e.g. 32 bit modular addition)
• $\operatorname{Dec}$ will be much slower on asymmetric systems for the same reason as the $\operatorname{Enc}$ reason
• $\operatorname{Enc}$ and $\operatorname{Dec}$ may also be more prone to side channel attacks for asymmetric systems.

Note that there are many different types of asymmetric primitives, each with different properties. So how efficient each one is for the different properties (size, speed, security) differs wildly between the systems.

So the main reason that symmetric cryptography is still useful is that these systems are much more efficient and secure than there asymmetric counterparts. However key management and key agreement is much harder for symmetric cryptosystems, which is where asymmetric cryptography steps in.

Often the two of them are combined, where the key management is performed using asymmetric cryptography (a PKI or Public Key Infrastructure normally involving digital certificates) and the bulk encryption is performed by symmetric cryptography. Such a cryptosystem is called a hybrid cryptosystem.

Can anybody let me know when private-key crytography is useful in practice?

Symmetric techniques tend to be significantly faster than asymmetric techniques. Encrypting data with AES and an appropriate mode of operation can yield throughput that is magnitudes of order greater than what the fastest implementations of RSA could possibly deliver. This difference is so great that encrypting any sizable amount of information with only RSA would take a prohibitive amount of time and be unusable in practice.

So symmetric cryptography techniques are useful pretty much everywhere in practice, from encryption of bulk data at rest (e.g. full-disk encryption) to encryption of data in transit (e.g. TLS)

If so, can it be replaced with public-key cryptography?

You could simply use asymmetric cryptography for everything. But there are much more intelligent ways to do things.

You can, for example, generate a regular symmetric encryption key and use that to encrypt your data quickly, and then use public-key encryption to secure the key. This nets the following advantages:

• You can use a new secret key per encrypted message
• But you only have to manage long-term control of a single private key, instead of $N$ secret keys for $N$ messages.

This highlights what Public-key cryptography is really good at: Key management.

Using public-key encryption to directly encrypt bulk data won't work out well in practice, because that's arguably not what the tool is supposed to be used for.