Each pair needs its own shared key, so the total is n·(n-1)/2 — quadratic in n. Worse, every new user has to securely exchange a key with every existing user before they can talk.

* Symmetric keys grow quadratically as n·(n−1)/2 — 4,950 for 100 users — while public-key grows linearly as n. *

Two compounding problems:

1. Storage: every user must store n−1 keys. Add a million users and each device holds nearly a million keys.
2. Distribution: how do you securely deliver each fresh pairwise key in the first place? A secure channel doesn't exist yet — that's the whole point of crypto.

The fix — public-key (asymmetric) cryptography. Each user has one keypair (public + private). Anyone who wants to talk to Alice uses Alice's public key; only she can decrypt. Number of keys grows linearly with n, not quadratically — and the public key can be shared on a billboard.

Tip: Modern systems are hybrid: asymmetric crypto only bootstraps a per-session symmetric key, then the actual data is encrypted symmetrically (1000× faster). TLS, SSH, Signal all work this way.

Go deeper:

• Key management (Wikipedia) — the operational problem of storing and distributing keys at scale.

Encryption is an "easy" mathematical function whose inverse (decryption without the secret) is presumed to be hard. Anyone can encrypt with the public key; only the holder of the private key can decrypt.

* The trapdoor at the heart of public-key crypto: multiplying 31×67 is trivial; factoring 2077 back into its primes is hard. *

The textbook analogy is multiplication vs. factorisation:

This one-way / trapdoor function is the foundation of every PK scheme. Encryption uses the public-key transformation; decryption needs the private "trapdoor" that makes the inverse easy.

Important caveats:

• "Hard" means we don't know an efficient algorithm. None of these are proven hard — RSA's security depends on factoring being hard, but mathematicians haven't ruled out a fast factoring algorithm. A working quantum computer running Shor's algorithm would break RSA in polynomial time.
• The scheme is asymmetric because the encrypt direction is easy for everyone, but decrypt is easy only with the private key.

Tip: The whole asymmetric crypto field hinges on "P ≠ NP and these specific problems are hard." If P = NP turned out true, factoring (and RSA) would fall — and the Clay $1M prize, plus a lot of internet security, would be the casualty.

Go deeper:

• Trapdoor function (Wikipedia) — easy one way, hard to invert without the secret trapdoor.