TL;DR
Public key encryption uses a mathematically linked pair of keys — one public, one private — to secure data in transit and verify sender identity. Unlike older symmetric systems, it eliminates the need for both parties to share a secret key in advance. While powerful, it carries risks such as brute-force attacks and man-in-the-middle vulnerabilities that require careful key management to mitigate.
How public key encryption works
Public key encryption actually uses two sets of keys. One, the public key, is shared widely with anyone you might like to connect with in the future. The other, the private key, is closely protected and known only to you.
Algorithms develop the keys. While they're related to one another, they can't be used to decode one another. Someone who has your public key must do quite a bit of complicated hacking to determine even the rough contours of your private key.
Systems like this preserve both privacy and efficiency. You know your data is protected in transit and at rest. But you don't need lengthy setup conversations with another party to get a connection started.
Experts say it's critical for everyone to understand cryptography, especially if people within your organization work from home. If you're not using public key encryption properly (or at all), you could be exposing your company to catastrophic risks.
What is a cryptographic key?
We all use keys every day to open up mailboxes, trunks, and doors. Cryptographic keys also lock and unlock barriers to allow access. But unlike their physical counterparts, crypto keys are not made of metal. Instead, they consist of code.
A cryptographic key scrambles numbers and letters so they're unreadable by humans. Your original text (plaintext) moves through a key and takes a new form (cipher). A key undoes the process.
Several types of cryptographic keys exist.
- Public: As the name implies, this type of key is widely available for anyone to see.
- Private: This form of key is closely guarded and protected. Only you should know about it.
- Hybrid: A combination of public/private keys is used in this complex system that is custom-made for very sensitive environments.
In the early days of computing, all companies used symmetric systems. Both parties needed copies of the same key to encrypt and decrypt data.
But as more companies came online and the need to communicate grew, tracking all of those keys became burdensome. In response, developers created asymmetric systems, like public key encryption. With this process, two parties need separate but related keys.
How does public key cryptography work?
Two parties with related keys communicate via public key cryptography. One key encrypts the data, and the other decrypts it.
Let's say Alice wants to send a message to Bob. An attacker, Tom, is listening. Alice:
- Uses Bob's public key to encrypt her message.
- Sends it to Bob.
- Waits for Bob to use his private key to decrypt it.
Because they're public, Tom has access to both the ciphertext and Bob's public key. However, Tom doesn't know what Bob's secret key is because Bob keeps it a secret.
What is a digital signature in public key cryptography?
What if Bob needs to verify that it was Alice that sent the message instead of Tom? This time, Alice:
- Encrypts a message for Bob with two keys: Bob's public key and her own private key.
- Sends the message.
- Waits for Bob to decrypt it using both his own private key and Alice's public key.
Because only Alice's private key could have encrypted a message that can be decrypted by her public key, and because Alice keeps her private key private, Bob knows that this message couldn't have come from anyone else. This is called a digital signature.
What are common applications of public key encryption?
In addition to digital signatures, public key encryption can be helpful for:
- Secure web connections. A website's security certificate (or Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate) contains a public key. Related private keys are installed on servers. The two parties have a "handshake" before data is transferred. Websites such as Google and SalesForce rely on this protocol.
- Bitcoin. This form of digital currency relies on public key cryptography for safety and security.
What are the strengths and weaknesses of public key cryptography?
Plenty of encryption methods exist. Should you rely on a public key system or lean on something else? Understanding the risks and benefits can help you make a smart decision.
| Strengths | Weaknesses |
|---|---|
| Confidentiality: only authorized recipients can read encrypted messages | Vulnerability to brute-force key search attacks |
| Authenticity: digital signatures confirm message integrity | Vulnerability to man-in-the-middle attacks |
| Non-repudiation: senders cannot deny message contents | Programming complexity and implementation challenges |
| Key management issues (training, administration, recovery) |
These benefits have uncovered many applications for public key cryptography, from Pretty Good Privacy (PGP) and Hypertext Transfer Protocol Secure (HTTPS) to OpenID Connect (OIDC) and Web Authentication (WebAuthn). It's also used for secure shell certificates, enabling admins to connect to servers everywhere without remembering their passwords.
But challenges do exist, including:
- Vulnerability to brute force key search attacks. Super-fast computers with plenty of processing power can run extensive searches to find out the details of private keys. In theory, this could take mere minutes.
- Vulnerability to man-in-the-middle attacks. A hacker can intercept a message, alter it, and fool the host computer into making an insecure connection. When that happens, a hacker can read through almost every message intended for your server.
- Programming challenges. Public key cryptography can be difficult to understand and implement from scratch, but thankfully for developers, there are many libraries available to handle the heavy lifting. The famous Networking and Cryptography Library (NaCl) provides an Application Programming Interface (API) called the Box API, which makes handling public key cryptography simple.
- Key management issues. A public key approach means you'll need to make sure you're thinking through how you'll handle user training and acceptance, system administration, maintenance and key recovery.
Help from Okta
At Okta, we use public key encryption in our own systems to verify encrypted sessions for our users. We've also built an extensive suite of tools you can use to ensure that the right people in your organization have the right permissions.
We can help you understand what encryption means and how it can help. We can also set up services for you. Contact us, and let's get started.
Frequently asked questions
What is the difference between a public key and a private key?
A public key is shared openly with anyone you might want to communicate with, while a private key is closely protected and known only to you. The two keys are mathematically linked: one encrypts data and the other decrypts it, but having the public key makes it extremely difficult to determine the private key.
Why did developers move from symmetric to asymmetric encryption?
In the early days of computing, symmetric systems required both parties to hold copies of the same key. As more companies came online and the need to communicate grew, tracking all of those keys became burdensome. Asymmetric systems like public key encryption solved this by allowing two parties to use separate but related keys instead.
What is a digital signature and how does it work?
A digital signature is created when a sender encrypts a message using both the recipient's public key and their own private key. The recipient can then decrypt the message using their own private key and the sender's public key. Because only the sender's private key could have produced a message decryptable by their public key, the recipient can verify the message's origin.
What are the main security risks of public key cryptography?
Two key risks are brute-force key search attacks, where powerful computers attempt to determine private key details, and man-in-the-middle attacks, where a hacker intercepts and alters messages to establish an insecure connection. Careful key management and implementation practices help mitigate these risks.
What is key management and why does it matter?
Key management refers to the processes surrounding how cryptographic keys are handled throughout their lifecycle, including user training and acceptance, system administration, maintenance, and key recovery. Without a solid key management approach, even a well-implemented public key system can become a security liability.
Where is public key encryption used in everyday technology?
Public key encryption underpins many common technologies, including Hypertext Transfer Protocol Secure (HTTPS) for secure web connections, Pretty Good Privacy (PGP) for email encryption, Bitcoin for digital currency security, OpenID Connect (OIDC) and Web Authentication (WebAuthn) for identity protocols, and secure shell certificates for server administration.
References
Why Cryptography Is a Key Cyber-Skill to Hone During Lockdown 2.0. (December 2020). ITProPortal.
What Makes the Bitcoin Blockchain Secure? (November 2020). Decrypt.
Symmetric Encryption Algorithms: Live Long and Encrypt. (November 2020). Security Boulevard.
Man-in-the-Middle Attacks: A Growing but Preventable Mobile Threat. (April 2020). Dark Reading.
IBM Cloud Gets Quantum-Resistant Cryptography. (November 2020). Silicon Angle.
