One question I had to answer in my crypto exam today was:
Do we need symmetric cryptosystems?
As it stands, that's probably a debatable question, so I'd like to reformulate this as:
Are there any situations where symmetric cryptosystems could not be replaced by asymmetric cryptosystems without serious downsides?
I'm not thinking of performance-related issues here; rather, I'm looking for things that would be impossible to achieve in an asymmetric-only model, or at least that would require prohibitively complex or costly implementations.
I would be interested to hear of any answer, since my teacher seemed to suggest that I was missing something, but he wouldn't say what (this was an oral examination).
Here's my personal thinking and answer:
I'd tend to say that symmetric crypto is not absolutely necessary, since:
- For two-party communication, using two asymmetric key pairs should be enough to make do without symmetric crypto.
- Generalizing to broadcasting or more-than-two-party communication, the sender would need to have keys for all recipients, but that should be sufficient.
- Signatures should be able to emulate MACs (with the requirement that every group member who would have shared the MAC key now needs to have every group member's public key)
- For encrypting data for personal use (single party), asymmetric encryption should be fine.
The only situation where I can think of difficulties is the distribution of public keys in the absence of a trusted party: in the contrived setting where Alice can securely send data to Bob, but Bob can't securely reply, Alice could transmit a symmetric key to use for subsequent exchanges, while in a fully asymmetric context Bob wouldn't be able to reliably send his public key to Alice. But this sounds like a somewhat contrived example, and I have no doubts that their are good ways of circumventing this (for example, Alice could generate a key pair for Bob, and send it to him).
Other weaknesses that I could think of were encryption & decryption speeds, and resistance to an hypothetical quantum computer, since current symmetric systems just need a doubling of the key length to maintain security, while asymmetric systems based on factoring would be brought to their knees. But then again we have lattice-based cryptography, so that's not a definitive reason why symmetric systems are needed.