Do we need symmetric cryptosystems? One question I had to answer in my crypto exam today was:


  Do we need symmetric cryptosystems?


As it stands, that's probably a debatable question, so I'd like to reformulate this as:


  Are there any situations where symmetric cryptosystems could not be replaced by asymmetric cryptosystems without serious downsides?


I'm not thinking of performance-related issues here; rather, I'm looking for things that would be impossible to achieve in an asymmetric-only model, or at least that would require prohibitively complex or costly implementations.

I would be interested to hear of any answer, since my teacher seemed to suggest that I was missing something, but he wouldn't say what (this was an oral examination).



Here's my personal thinking and answer: 

I'd tend to say that symmetric crypto is not absolutely necessary, since:


For two-party communication, using two asymmetric key pairs should be enough to make do without symmetric crypto.
Generalizing to broadcasting or more-than-two-party communication, the sender would need to have keys for all recipients, but that should be sufficient.
Signatures should be able to emulate MACs (with the requirement that every group member who would have shared the MAC key now needs to have every group member's public key)
For encrypting data for personal use (single party), asymmetric encryption should be fine.


The only situation where I can think of difficulties is the distribution of public keys in the absence of a trusted party: in the contrived setting where Alice can securely send data to Bob, but Bob can't securely reply, Alice could transmit a symmetric key to use for subsequent exchanges, while in a fully asymmetric context Bob wouldn't be able to reliably send his public key to Alice. But this sounds like a somewhat contrived example, and I have no doubts that their are good ways of circumventing this (for example, Alice could generate a key pair for Bob, and send it to him).

Other weaknesses that I could think of were encryption &amp; decryption speeds, and resistance to an hypothetical quantum computer, since current symmetric systems just need a doubling of the key length to maintain security, while asymmetric systems based on factoring would be brought to their knees. But then again we have lattice-based cryptography, so that's not a definitive reason why symmetric systems are needed.
Yes, we need symmetric cryptosystems, for many reasons; to give three of these:


We need a hash function to make most asymmetric cryptosystems secure (e.g. we simply do not have a secure signature system based on RSA without a hash), and current hash functions are (or are built from) symmetric cryptosystems.
All asymmetric encryption cryptosystems are bound to output ciphertext larger than the plaintext, and there are situations where this is a major drawback (e.g. bulk disk encryption).
The best asymmetric encryption cryptosystems we have around are some orders of magnitude slower/more energy-hungry than state-of-the-art symmetric ones; it turns out this worsens, badly, if we want to minimize the ciphertext expansion ratio by using huge parameters.


Note: Point 1 has the appearance of being sufficient to prove my assertion, but it is debatable to a degree: perhaps in this question we want the big picture only, and disregard the symmetric internals of all existing asymmetric cryptosystems; and/or perhaps we could devise asymmetric-based hashes (though these would be symmetric cryptosystems in disguise).
Also: we could live with 2, if there was not 3, which in the end is the real killer.