I'm designing a system where the client asked for documents to be encrypted with "asymmetric cryptography".
I've explained them that the best practice is to encrypt the data with a symmetric algorithm using a randomly generating key and then, using an asymmetric algorithm, to encode that key. The entire scheme is "asymmetric" but it uses multiple algorithms. I offered the usual performance/convenience arguments.
However they are insisting that we should only use asymmetric algorithms because they "have read that is better".
I'm preparing a note for them to better explain the topic and I would greatly benefit of official documents. I browsed the NIST, FIPS, RFC documents and so on but they are too wide to be used as a reference for a customer that is not well versed on this topic.
Does anyone have some pointers to authoritative sources that explain the best practices and that I could use to back up my arguments?