Public-key cryptography
Contents
Public-key cryptography
Public-key cryptography, also called asymmetric cryptography, is a system that uses pairs of mathematically linked keys. Unlike symmetric cryptography, which uses one shared secret key for everything, public-key crypto uses two distinct keys: a public key everyone can see, and a private key only the owner knows.
This groundbreaking idea, from the 1970s, solved the big problem of securely sharing keys in symmetric cryptography. Public-key crypto lets people with no prior connection communicate securely over an insecure channel and confirm who they are. Its main uses are for confidentiality (keeping data secret) and for authentication and non-repudiation (proving who sent data and that it hasn't been changed, meaning the sender can't deny it) using digital signatures.
Key Concepts
Public-key cryptography is built on the idea of a key pair, two mathematically linked keys generated together:
Public Key: This key is shared freely. Anyone wanting to encrypt a message for the owner (so only they can read it) or verify the owner's digital signature needs this key. Often, it's part of a digital certificate from a trusted authority. Private Key: This key must be kept secret by its owner. It's mathematically linked to the public key, but you can't figure it out from the public key. It's used to decrypt messages encrypted with its paired public key and to create digital signatures. If this key is compromised, the whole security system breaks. Key Pair: The public and private keys together. What one key does, only the other key in the pair can undo or verify.
How it Works
Public-key cryptography performs two main secure operations using these key pairs:
Encryption for Confidentiality (Privacy):
To send a secret message to User B, User A gets User B's public key (which is public). User A uses User B's public key to encrypt the message, turning readable text (plaintext) into unreadable text (ciphertext). User A sends the ciphertext to User B. User B receives the ciphertext and uses their own secret private key to decrypt it back into the original message. Since only User B has the correct private key, only they can read the message, ensuring privacy. Digital Signatures for Authentication, Integrity, and Non-repudiation (Proving Identity and Data):
If User A wants User B to confirm the message is truly from User A and hasn't changed, User A first creates a unique "fingerprint" of the message (a hash). User A then uses their secret private key to "sign" this fingerprint, creating a digital signature. User A sends the message and the digital signature to User B. User B receives both. User B independently creates their own fingerprint of the message. User B then uses User A's public key to verify if the received digital signature matches User B's newly created fingerprint. If it matches, User B knows: It's genuinely from User A (authentication), because only User A has that private key. The message hasn't been altered (integrity), because any change would break the signature. User A can't deny sending it later (non-repudiation).
History
The core idea of public-key cryptography was a major breakthrough, discovered independently by several groups in the 1970s. Whitfield Diffie and Martin Hellman first published it in 1976, introducing asymmetric cryptography and the Diffie–Hellman key exchange, which allowed two parties to securely agree on a shared secret key even over an insecure channel.
In 1977, Ron Rivest, Adi Shamir, and Leonard Adleman at MIT developed RSA, the first widely used public-key encryption and digital signature algorithm. Its security relies on the difficulty of factoring large prime numbers.
Later, it was revealed that similar ideas were developed earlier by British intelligence (GCHQ) in the 1960s-70s by James Ellis, Clifford Cocks, and Malcolm Williamson. This work remained secret and didn't impact public development.
Common Algorithms
Public-key cryptography uses several mathematical algorithms, differing in their math, performance, and use cases:
RSA: One of the oldest and most used public-key systems. Its security relies on the difficulty of factoring large numbers. Used for both encryption and digital signatures. Diffie–Hellman key exchange: A protocol for securely agreeing on a shared secret symmetric key over an insecure channel. Its security comes from the difficulty of the discrete logarithm problem. It's a core part of many secure protocols. Elliptic Curve Cryptography (ECC): A newer set of algorithms offering similar security to RSA but with shorter keys. This means faster computations and less power use. ECC is based on elliptic curves and is used for digital signatures (like ECDSA) and key exchange (like ECDH).
Applications
Public-key cryptography is a core part of modern information security, essential for many applications, especially in networking:
Securing Web Traffic (HTTPS): TLS (Transport Layer Security) secures HTTPS. It uses public-key crypto in the handshake to verify the server (via a digital certificate) and securely exchange a symmetric key. Then, a faster symmetric algorithm like AES encrypts the bulk of data. Secure Shell (SSH): Used for secure remote access to servers. Public-key authentication is more secure than passwords. You create a key pair, put the public key on the server, and authenticate by proving you have the private key locally. VPNs: Create secure, encrypted tunnels over public networks. Public-key cryptography often authenticates endpoints and sets up the symmetric key for the tunnel. Secure Email (PGP, S/MIME): Provide end-to-end email security. You encrypt emails with the recipient's public key for privacy and digitally sign them with your private key to verify your identity and message integrity. Digital Signatures (Code Signing, Package Verification): Verify the authenticity and integrity of software, documents, and data. Used for signing code or checking downloaded software packages (e.g., with GPG). Cryptocurrencies: A core technology for most cryptocurrencies like Bitcoin. Your wallet holds a key pair: the public key creates your address for receiving funds, and the private key signs transactions to spend them. API Security: Secures API communications by requiring clients to sign requests for authentication or by using TLS to encrypt the channel.
Advantages
Public-key cryptography offers big advantages, especially for distributed systems and open networks:
Secure Key Exchange: Solves the problem of securely exchanging secret symmetric keys over insecure channels, crucial for TLS connections. Authentication and Non-repudiation: Digital signatures strongly verify a sender's identity and data integrity, preventing them from denying they sent or signed data. Scalable Key Management: In a symmetric system, many keys are needed for multiple users. Public-key systems need only one key pair per user, simplifying key management in large networks, though Public Key Infrastructure (PKI) for trust adds its own complexities.
Disadvantages and Challenges
Despite its power, public-key cryptography has drawbacks and challenges:
Performance: Public-key operations are much slower than symmetric ones. That's why hybrid systems (using both) are typically used for large amounts of data. Key Management and Trust (PKI): While sharing public keys is easy, verifying a public key's true owner is complex. Public Key Infrastructure (PKI) handles this through trusted Certificate Authorities that issue digital certificates. If PKI is compromised, trust in public keys is broken. Vulnerability to Quantum Computing: Many current public-key algorithms (like RSA and ECC) are vulnerable to future quantum computers using Shor's algorithm. This drives research into post-quantum cryptography.
Relation to Symmetric Cryptography (Hybrid Cryptography)
Because public-key operations are much slower than symmetric ones, they're almost always used together in a hybrid cryptosystem. Public-key cryptography handles the initial setup: it authenticates parties (like servers using digital certificates and signatures) and securely exchanges a fast, symmetric session key over an insecure channel (e.g., using Diffie–Hellman or RSA). Once that symmetric key is secure, the much faster symmetric algorithm (like AES) encrypts the bulk of the data transfer. This blends public-key's benefits for setup and authentication with symmetric encryption's speed for data.
