AES or RSA? Symmetric, Asymmetric and What Morse Code Is Not

#Symmetric and asymmetric encryption differ in one sentence

Symmetric encryption uses one shared key for both directions; asymmetric encryption uses a key pair, with the public key encrypting and the private key decrypting. That single difference dictates the speed, the usable length and the right use case.

Hand a long paragraph to AES / DES Encrypt and it finishes instantly; hand the same paragraph to RSA and it slows down visibly before hitting a hard length limit.

#Which AES mode should you pick

Use AES-GCM for anything new, because it authenticates as it encrypts. Reach for CBC only when an existing system forces you to.

AES / DES Encrypt offers these combinations:

CBC has a known weakness: an attacker who flips one byte of ciphertext can cause a predictable change in the decrypted plaintext. GCM computes an authentication tag over the ciphertext, so modified data simply fails to decrypt.

#Why a key and an IV must never be reused

The same key plus the same IV plus the same plaintext always produces the same ciphertext, so an attacker can spot identical records without decrypting anything.

IV reuse does the most damage on fixed-format data:

• A nightly report with an unchanging structure emits the same ciphertext block for the same field
• The distribution of values, and how many records are duplicates, becomes visible
• If the plaintext is guessable - a handful of status values, say - an attacker can build a lookup table

So use a fresh IV for every encryption and store it beside the ciphertext. An IV is not a secret; it only has to be unique, and unpredictable as well under CBC:

storage: [ IV (16 bytes) ][ ciphertext ]
encrypt: make a random IV -> encrypt with IV + key -> store both
decrypt: read the first 16 bytes as the IV -> decrypt with IV + key

#RSA can only encrypt data shorter than its key

RSA's single-pass limit is set by the key size: about 190 bytes for a 2048-bit key and about 446 bytes for 4096 bits. One byte over and it errors out.

The limit comes from the formula key bytes - 2 x hash length - 2. A 2048-bit key is 256 bytes, SHA-256 is 32 bytes, and 256 - 64 - 2 = 190.

So the real-world pattern is not "encrypt data with RSA" but "encrypt an AES key with RSA, then encrypt the data with AES". An AES-256 key is only 32 bytes, which RSA handles easily.

#Do not reverse the public and private key roles

Two directions cover everything you need: public key encrypts and private key decrypts; private key signs and public key verifies.

Encrypting with the private key and decrypting with the public key is mathematically possible, but since the public key is public, anyone can undo it. It therefore proves nothing about confidentiality and exists purely inside digital signatures.

RSA Encrypt generates 2048, 3072 or 4096-bit key pairs and can import existing PEM keys. Long input is chunked automatically.

For keys you intend to keep, generate them locally:

openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

#Morse code is not encryption

Morse code is a completely public encoding table that anyone can reverse, so it offers no confidentiality at all.

There is only one test that matters: if you need a key to reverse it, it is encryption; if you do not, it is encoding.

Use Morse Code to convert between text and dots and dashes, with / separating words:

SOS    -> ... --- ...
HELLO  -> .... . .-.. .-.. ---

#Which tool for which job

#Frequently asked questions

#If AES is enough, why do we still need RSA?

Because AES requires both sides to already share a key, and getting that key to the other party safely is the hard part. RSA solves exactly that step: the public key travels openly, the private key never leaves your machine, and only you can decrypt the AES key someone encrypted for you. They work as a pair, not as alternatives.

#Which is more secure, AES or RSA?

Used correctly, both are strong enough; the difference is fit. AES-256 has a 2^256 key space with no feasible brute-force route, and RSA-2048 rests on the difficulty of factoring large integers. Almost every real breach comes from misuse - a reused IV, a key hard-coded in source, or a mode without integrity checking.

#What is the difference between a key and an IV?

The key must stay secret. The IV does not, but it must be unique every time, and unpredictable as well under CBC. Its purpose is to make the same plaintext encrypt differently under the same key. Store the IV in the clear in front of the ciphertext and read it back before decrypting.

#Why does encrypting a long string with RSA fail?

RSA-OAEP can encrypt key bytes minus 2 x hash length minus 2 bytes in one pass. With a 2048-bit key and SHA-256 that is 190 bytes, and a single extra byte raises an error. RSA Encrypt chunks long input automatically, but the better design is to encrypt an AES key with RSA and let AES handle the body.

#Can Morse code be used to encrypt a message?

No. The Morse table is public and any online lookup reverses it instantly, which puts it in the same category as Base64 and URL encoding: it changes the representation and nothing else. If reversing it needs a key it is encryption; if it does not, it is encoding - and that test works for every scheme.