Definition
Asymmetric encryption, also called public-key cryptography, was a breakthrough of the 1970s. Each party generates a key pair: a public key that can be freely distributed, and a private key kept secret. Anything encrypted with the public key can only be decrypted with the matching private key, and vice versa. The most widely used algorithms are RSA, Elliptic Curve Cryptography (ECC), and Diffie-Hellman key exchange.
Why It Exists
Symmetric ciphers like AES are extremely fast but require both parties to share the same key. The challenge is: how do you exchange that key over a hostile network? Asymmetric encryption solves this elegantly. Two parties who have never met can use each other's public keys to negotiate a shared secret in the open, and a passive observer learns nothing. That shared secret is then handed off to a faster symmetric cipher for the actual data transmission.
Role in a VPN
Every VPN session begins with an asymmetric handshake. The client verifies the server's certificate (which contains its public key), proves it is talking to the right server, and exchanges keying material — typically using Elliptic Curve Diffie-Hellman (ECDH). Once both sides agree on a session key, the VPN switches to symmetric encryption (AES-GCM or ChaCha20-Poly1305) for performance. This hybrid model is the foundation of TLS, IKEv2/IPSec, OpenVPN, and WireGuard.