Question 1

What is the difference between symmetric and asymmetric encryption?

Accepted Answer

**Symmetric** encryption uses the **same key** to encrypt and decrypt. **Asymmetric** uses a **pair** of mathematically related keys — one public, one private — where what one encrypts only the other can decrypt.

**Symmetric encryption.** AES is the standard. It is **fast** — orders of magnitude faster than asymmetric — and well suited to bulk data, with hardware acceleration on modern processors.

**Its problem is key distribution.** Both parties need the same secret key, and getting it to the other party securely is the original difficulty. You cannot send it over the channel you are trying to protect.

**Asymmetric encryption.** RSA and elliptic curve cryptography are the common families. The **public key** can be published freely; the **private key** is never shared.

This solves key distribution entirely: anyone can encrypt a message to you using your public key, and only your private key can decrypt it. No prior secret is needed.

**It also enables digital signatures**, running the process in reverse. Signing with your private key produces something anyone can verify with your public key, proving both **authenticity** and **integrity** — and providing **non-repudiation**, which symmetric cryptography cannot.

**Its problem is speed.** Asymmetric operations are computationally expensive, making them impractical for large volumes of data.

**How real systems combine them — hybrid encryption.** This is what TLS, HTTPS, Signal, PGP and essentially every practical system does:

**Asymmetric cryptography is used briefly**, to authenticate the parties and establish a shared secret.

**A symmetric session key is derived** from that exchange.

**All subsequent data uses symmetric encryption**, which is fast.

You get asymmetric's key distribution and authentication with symmetric's performance.

**Related concepts:** a **hash function** is one-way with no key, used for integrity and passwords. **Key exchange** protocols such as Diffie-Hellman establish shared secrets without transmitting them, and **forward secrecy** uses ephemeral keys so past traffic stays safe if a long-term key leaks.

Question 2

What are the best practices for REST API security?

Accepted Answer

Implementing best practices for REST API security, such as authentication, HTTPS, and input validation, is crucial for protecting sensitive data and preventing unauthorized access.

Question 3

What is a WebSocket, and when do you actually need one?

Accepted Answer

A protocol providing a persistent, bidirectional connection between client and server over a single TCP connection — so the server can send data without being asked, which ordinary HTTP

Question 4

What is a message queue and when do you need one?

Accepted Answer

A message queue sits between a producer of work and a consumer of it, holding messages until they can be processed. It converts a synchronous call into an asynchronous one. What it gives you:

Question 5

Why should I never store passwords in plain text?

Accepted Answer

If passwords are stored as written, anyone who obtains the database obtains every account immediately. That includes an attacker exploiting an unrelated vulnerability, a backup left accessible, or an

Question 6

What is a JWT, and when should you not use one?

Accepted Answer

A JSON Web Token is a signed, self-contained token carrying claims — typically who the user is and when the token expires — which a server can verify without a database lookup. That property is its

Question 7

When should I use a database transaction?

Accepted Answer

The rule is simple to state: use a transaction whenever two or more writes must either all succeed or all fail. If a partial result would leave your data in a state that should never exist, those

Related Questions