What exactly is asymmetric about 'asymmetric cryptography'?

https://www.sysadmins.lv/blog-en/digital-signatures.aspx says:

"In other words, anything that is encrypted by a public key can be decrypted by corresponding private (or secret) key only and vice versa."

This doesn't sound asymmetric. Does the asymmetry start only when one of the keys is subsequently (arbitrarily) labelled as the private key?

(Edit) https://stackoverflow.com/a/1373088/16019190 is a +51 votes answer and it contains this statement: "The theoretical private key is the couple (d, n) which shares perfect symmetrical (mathematical) relation with (e, n). If you are comparing these, one cannot be computed from the other."

  • 5
    $\begingroup$ In symmetric cryptography, both sites use the same key so the systems are symmetric, in asymmetric cryptography both site uses different keys. $\endgroup$
    – kelalaka
    May 30, 2021 at 18:14
  • 2
    $\begingroup$ Also, that blog is completely wrong. In long-obsolete naive broken textbook RSA ONLY you can swap the public and private exponents e and d, but not in any scheme that is used this century, and signature does not use encryption at all -- signing is NOT 'encrypting with the private key' as long-out-of-date people think; see list at security.stackexchange.com/questions/159282/#159289 $\endgroup$ May 31, 2021 at 3:06
  • 1
    $\begingroup$ Addition to the above comment: specifically, the "and vice versa" part of the quote is not conforming to well-established conventions of academic cryptography since the 1990's, and wrong with many modern schemes. $\endgroup$
    – fgrieu
    May 31, 2021 at 4:41
  • 1
    $\begingroup$ Don't read arbitrary answers on Stack Overflow about cryptography. We occasionally find many mistakes there that we can't fight since they have many votes to fight. Thomas, Maarteen, Ilmarani Korean, Dave Thompsom, etc, are fine, rest, be careful. $\endgroup$
    – kelalaka
    Jun 1, 2021 at 0:06

2 Answers 2


It doesn't matter how you label they keys. Important is if decryption requires the same key as encryption or a different key.

In case of AES, ChaCha20, ThreeFish the same key is required for decryption as the one used for encryption. That's why it is called symmetric.

In case of RSA, ECC a key needed to decrypt is different from what was used to encrypt. It is not that they are just two equivalent keys for the same purpose. After you encrypt a message with one key, it is just impossible to decrypt it using the same key. To decrypt, another key from the key pair needs to be used. That's why it is called asymmetric.


The most commonly understood meaning of 'asymmetric' in this context is that there are two different keys used, one for encryption and one for decryption, as opposed to symmetric cryptography where just one key is used for both encryption and decryption.

Presumably the 'symmetry' is seen in the diagram of the process: plaintext, plaintext and key, ciphertext, ciphertext and key, plaintext. There is key symmetry, one could say. The 'asymmetric' process is: plaintext, plaintext and public key, ciphertext, ciphertext and private key, plaintext. There is key asymmetry because on one side there is the public key and on the other there is the private key.

Here is a quote from this answer https://security.stackexchange.com/a/70458/257850:

"This is the path used when proving the encrypted data hasn't been tempered with, commonly known as a digital signature[1].

The part the diagram leaves out is that the commonly accepted technique for digital signatures is to use a hash function, like SHA-256, to represent the data, then sign the hash. It reduces the amount of data being transmitted and reduces the amount of data available to an attacker to reverse engineer the private key."

This means that 'encrypting' a message with the private key, besides being better called 'signing', comes with the danger of providing clues publicly to potential adversaries as to what your private key is. This is especially a problem if this is done on many occasions with the one private key. By instead deriving a hash from the message, and encrypting (signing) that, you reduce the amount of clues given.

Referring to signing with a private key as 'encryption' with a private key could lead to someone thinking that a secret message is safe because it was 'encrypted'. In other words, there is more than one kind of encryption, and some kinds do not provide secrecy, and ironically, using a 'private key' is the way to inadvertently make your information public. Indeed, one has less privacy than before. Not only is your message available to be seen by all, but you have drawn attention to it by attempting unsuccessfully at encrypting it properly, and you have signed your name to it, letting everyone know exactly who sent it and resulting in your having no plausible deniability anymore.

It's counter intuitive, perhaps, for the layman, that the last thing you should do with private information is to encrypt it with your private key. The layman might not understand that the key is called 'private' because it needs to be kept private, and that is does not make a message private, but rather it signs the message robbing you of plausible deniability (although if you say that your private key somehow got stolen or accidentally was revealed to others well before you signed that message you might get back a little deniability).

That's one reason not to call signing with the private key, 'encryption with the private key'.

This answer (https://security.stackexchange.com/a/159289/257850) has this statement:

"[S]ignature is not encryption with the private key -- not even for RSA, where there is enough similarity in the mathematical underpinning that it is dangerously appealing to think this even though there are vital differences in the actual schemes and trying to interchange them leads to very bad results, and totally completely not at all for other algorithms like DSA and ECDSA."

I take this to mean that mathematically it sort of, at least, is true that signing with the private key is encryption with the private key, but in the software implementations in real life, it is a terrible idea to think of at this way, let alone say it out loud when employees, or anyone else you are entrusting your data to, are around.

  • $\begingroup$ reverse engineer the private key? The main target of an attacker against a signature is forgery not key recovery. Hashing is the part of the security of signatures. This means that 'encrypting' a message with the private key What? This answer has many errors! $\endgroup$
    – kelalaka
    Jun 1, 2021 at 0:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.