What is hybrid encryption?
Hybrid encryption combines the two families of cryptography so each handles the part it is good at. Public-key (asymmetric) algorithms solve the problem of sharing a key with someone you have never exchanged a secret with, but they are slow and can only process small inputs. Symmetric ciphers such as AES can encrypt gigabytes quickly but need both sides to hold the same key. A hybrid scheme uses the public-key step only to establish a short random symmetric key, often called a session key or data key, and then encrypts the real content with it. Nearly every practical encryption system works this way, including TLS, SSH, IPsec, PGP, S/MIME and encrypted messaging apps.
Two ways to set up the symmetric key
- Key transport, or key wrapping: the sender generates a random key, encrypts the data with it, then encrypts that key with the recipient's public key. Only the recipient's private key can unwrap it. PGP and S/MIME email and Windows EFS follow this pattern.
- Key agreement: both sides run a Diffie-Hellman exchange, usually ephemeral ECDHE, and each derives the same session keys without the key ever crossing the network. TLS 1.3, SSH and IPsec work this way.
A more formal building block is the key encapsulation mechanism (KEM), whose public-key step produces a fresh shared secret together with a ciphertext that lets the recipient recover it. Hybrid Public Key Encryption (HPKE, RFC 9180) packages a KEM, a key derivation function and an authenticated cipher into one standard, and the post-quantum algorithm ML-KEM is also a KEM.
A worked example
A backup job has to send a 2 GB archive to five administrators, each holding a 3072-bit RSA key pair. The software generates one random 256-bit AES key and encrypts the archive once with AES-GCM. It then encrypts the 32-byte AES key five times, once with each administrator's public key. Each RSA-3072 result is 384 bytes, so the whole recipient list adds less than 2 KB to a 2 GB file. Encrypting the archive with RSA directly isn't workable: a 3072-bit key can process only a few hundred bytes per operation, and splitting 2 GB into pieces that small would be extremely slow. Adding a sixth administrator later means wrapping the same small key once more, not re-encrypting the archive.
Security depends on both halves
A hybrid system is only as strong as its weaker part. The symmetric key must come from a cryptographically secure random generator and should be unique to each message or session. The public-key step decides what a later theft exposes. With key transport, anyone who steals a recipient's private key afterward can unwrap every stored session key and read everything ever sent to that recipient. With ephemeral key agreement, session keys are thrown away after use, which provides forward secrecy. That difference is the reason TLS 1.3 dropped RSA key transport and uses ephemeral Diffie-Hellman for every full handshake.
Hybrid encryption vs. hybrid key exchange
The word hybrid is used in two senses. Hybrid encryption means asymmetric plus symmetric, as described here. A hybrid key exchange, in the post-quantum sense, combines a classical algorithm such as X25519 with a post-quantum one such as ML-KEM, so the session key stays safe unless both are broken. A modern TLS 1.3 connection can be both at once: a hybrid key exchange sets up the session key, and AES-GCM or ChaCha20-Poly1305 encrypts the traffic.
Hybrid encryption on the CompTIA Security+ exam
Hybrid encryption is taught with asymmetric encryption and key exchange under SY0-801 objective 1.3, the cryptographic solutions objective, and questions about how symmetric encryption, asymmetric encryption and key exchange fit together test exactly this idea. Wording such as "how does HTTPS protect a large download efficiently" or "encrypt one file for several recipients without encrypting it several times" points to an asymmetric step that protects a symmetric key. Distractors include answers in which the server's public or private key encrypts the whole session, Diffie-Hellman encrypting data directly, when it only agrees on a key, and hashing, which provides integrity rather than confidentiality.