Apps & Data Security · 5.4
🔑 Asymmetric Cryptography
Public keys, private keys, and knowing which key to use for which purpose⏱ ~2 min
📬Asymmetric encryption is a special padlock system
Imagine everyone has a special padlock (public key) they give to anyone who wants to send them a secure message. Anyone can lock a box with your padlock, but only you have the key to open it (private key). To prove a message came from you, you use your private key to 'sign' it — anyone with your public key can verify the signature, but only you could have created it. One key pair, two different uses: encrypt (use recipient's public key) or sign (use your own private key).
The Key Pair: Public and Private
- •Public key: share freely — post it on your website, email it to anyone, publish it in a directory. There's no security risk in others having your public key.
- •Private key: NEVER share — stays on your device, ideally in a hardware security module (HSM) or secure enclave. If compromised, all trust in that key pair is destroyed; revoke and regenerate immediately.
- •Mathematical relationship: the two keys are generated together using math (RSA, ECC) such that what one encrypts, only the other can decrypt. But deriving the private key from the public key is computationally infeasible.
- •Asymmetric encryption is slow: used for small data operations (key exchange, digital signatures) not bulk encryption. Typically used to establish a shared symmetric key, then switch to AES for data.
Six Use Cases — Choosing the Right Key
| Goal | Security Objective | Which Key? | Who Uses It | Why |
|---|---|---|---|---|
| Send Alice a secret message only she can read | Confidentiality | Alice's PUBLIC key to encrypt | Sender (you) | Only Alice's private key can decrypt — she's the only one who can read it |
| Prove a message came from Alice | Authentication | Alice's PRIVATE key to sign | Alice | Only Alice has her private key; anyone with her public key can verify the signature |
| Verify a message wasn't modified in transit | Integrity | Alice's PRIVATE key to sign hash | Alice | If any bit changes, the hash changes; signature verification fails |
| Send message only Alice can read AND prove it came from you | Confidentiality + Authentication | Alice's public (encrypt) + YOUR private (sign) | Both | Two separate operations: encrypt with recipient's public key; sign with sender's private key |
| Establish a shared secret without exchanging keys | Key Exchange | Diffie-Hellman algorithm | Both parties | DH allows both sides to independently derive the same session key; used in TLS handshake |
| [TRAP] Encrypt with your OWN private key for 'secrecy' | FAILS confidentiality | Wrong key choice | — | Anyone with your public key (which is public!) can decrypt it — provides zero confidentiality. Don't do this. |
Real-World Application: HTTPS / TLS Handshake
- 1.Browser requests server's public key certificate (signed by a trusted CA)
- 2.Browser verifies the certificate is legitimate (CA's digital signature validates)
- 3.Browser generates a random session key and encrypts it with the server's public key
- 4.Server decrypts with its private key — now both have the same session key
- 5.All further communication encrypted with symmetric AES using the shared session key
- 6.Result: asymmetric crypto for key exchange, fast symmetric crypto for data — best of both
★ FactThe most common attack on asymmetric cryptography isn't breaking the math — it's key management failures. The 2011 RSA SecurID breach: attackers stole seed values used to generate OTP tokens, compromising millions of hardware tokens. The DigiNotar CA breach (2011): attackers issued fraudulent certificates for Google.com, enabling man-in-the-middle attacks against Iranian users. Certificate revocation and CA trust are the real challenges in asymmetric cryptography at scale.
🧠Quick Checkfirst try = +5 XP
Alice wants to send Bob a message that (1) only Bob can read, and (2) proves the message came from Alice. Which combination of keys does Alice use, and in what order?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days