Definition
Symmetric encryption uses a single key for both encryption and decryption. The same key that encrypts the message must be used to decrypt it, which means both parties must share that key in advance. Symmetric ciphers are vastly faster than asymmetric ones — by orders of magnitude — making them the right choice for encrypting large volumes of data. AES and ChaCha20 are the dominant symmetric ciphers in use today.
The Key Distribution Problem
Symmetric encryption has one fundamental challenge: how do two parties safely share the secret key in the first place? You cannot send it in the clear, or an eavesdropper learns it. Before public-key cryptography was invented, this was solved by physical key distribution — couriers, sealed envelopes, in-person meetings — which scales poorly. The breakthrough of asymmetric cryptography (Diffie-Hellman, RSA) was that two strangers could agree on a shared symmetric key over an open network without ever meeting.
How VPNs Combine Both
Every modern VPN session is a hybrid. The handshake uses asymmetric cryptography (Diffie-Hellman for key exchange, RSA or ECC for authentication) to establish a shared symmetric key. Once that key is in place, the actual data is encrypted with a symmetric cipher (AES-GCM, ChaCha20-Poly1305) for performance. The asymmetric step happens once at session start; the symmetric step runs continuously for the rest of the session.