Why Crypto uses symmetric key instead of assymetric for enterprise encryption?

[mensfeld]

I've been looking through the docs for Sidekiq Enterprise, and I've noticed that encryption it uses a symmetric key instead of asymmetric for Sidekiqs Crypto. May I ask why?

[mperham]

At the time the feature was written in 2015, AES was considered best practice with years of widespread use. Is that what you mean? I'm not a crypto expert so I don't know what you mean by using asymmetric.

[mensfeld]

Based on my understading you use symmetric key, that is on that uses the same cryptographic keys for both the encryption of plaintext and the decryption of ciphertext.

Use-case I am trying to explore here is one where a different app produces jobs and a different consumes them. This means, that with assymetric key I could use a public key to encrypt messages but a private one to decrypt them.

Based on my understanding of OpenSSL::Cipher it provides symmetric algorithms for encryption and decryption. Meaning that if my job producing app is exploited, attacker would be able to obtain key allowing him to decrypt private content.

[mperham]

I think I understand your point. You are welcome to open an issue asking for this feature but I don’t know enough about public/private key encryption to know if this is a good idea in practice. I have a lot of Sidekiq 7.0 work happening right now so I won’t be able to investigate this for some time.

[mensfeld]

Nah. It's ok. I can bypass that on an app layer. I was just interested in the architectural choice.

You have satisfied my curiosity, for which I thank you sincerely.