Encryption, Encryption Protocols and Digital Certificates — common mistakes

In an exam, be precise with your terminology. A common mistake is to confuse the roles of the public and private keys. Remember: you encrypt with the recipient's public key, and they decrypt with their own private key. Also, be aware that TLS is the modern standard, but questions may still refer to SSL/TLS.

The primary reason is performance. Asymmetric encryption involves complex mathematical operations and is significantly slower (more computationally expensive) than symmetric encryption. For a web session that involves transferring a lot of data, using asymmetric encryption for everything would be too slow and resource-intensive. Therefore, TLS uses the slower, more secure asymmetric method only at the beginning to verify identities and securely exchange a brand new, temporary symmetric key (a 'session key'). The rest of the session's data is then encrypted and decrypted quickly using this shared session key.

SSL (Secure Sockets Layer) was the original protocol for securing web traffic. TLS (Transport Layer Security) is its direct successor. Over the years, several versions of SSL were released, but significant security vulnerabilities were discovered. TLS was developed to address these flaws and provide stronger encryption. While you'll often see the terms used interchangeably (e.g., 'SSL/TLS certificate'), all modern, secure systems use TLS. For your exam, you can consider TLS as the current, more secure version of SSL.