Asymmetric Encryption: Public and Private Keys

The "Mailbox" Analogy

Asymmetric encryption (also called Public-Key Cryptography) solves the key distribution problem elegantly by using a mathematically linked pair of keys instead of one shared key:

1. Public Key: This key can be shared with the entire world — posted on your website, included in your email signature, published in a directory. It is used to encrypt data intended for you, or to verify signatures you create.
2. Private Key: This key must be kept completely secret and never shared with anyone. It is used to decrypt data that was encrypted with your matching public key, or to create digital signatures.

The mathematical relationship between the two keys is one-way: knowing the public key does not allow you to derive the private key (within the bounds of current computational limits). Data encrypted with the public key can only be decrypted with the corresponding private key.

Think of it like a public mailbox on the street. Anyone can walk up and drop a letter through the slot — they only need to know where the mailbox is (the public key). But only the postal worker with the unique private key can open the locked compartment at the bottom and retrieve the letters.

The Mathematics Behind It

The security of asymmetric encryption rests on mathematical problems that are easy to perform in one direction but computationally infeasible to reverse:

• RSA (Rivest–Shamir–Adleman): Security relies on the difficulty of integer factorization — it's easy to multiply two large prime numbers together, but extraordinarily hard to factor the result back into its original primes. RSA key sizes of 2048 or 4096 bits are standard.
• ECC (Elliptic Curve Cryptography): Security relies on the elliptic curve discrete logarithm problem. ECC achieves equivalent security to RSA with much smaller key sizes — a 256-bit ECC key provides roughly the same security as a 3072-bit RSA key. Smaller keys mean faster operations and less bandwidth, making ECC the preferred choice for modern systems, including TLS 1.3 and SSH.

Pros and Cons

• Pro — Solves Key Distribution: You can freely publish your public key. Anyone can use it to send you a secure message without any prior secret exchange. This is what makes secure communication with strangers on the internet possible.
• Con — Slow: Asymmetric operations are orders of magnitude slower than symmetric operations due to the complex mathematics involved. RSA encryption of a 1MB file is thousands of times slower than AES encryption of the same file. Asymmetric encryption is never used for bulk data.

The Hybrid Approach: How TLS Actually Works

Real-world protocols combine both types to get the best of both worlds:

1. Asymmetric phase (Key Exchange): The client uses the server's public key to securely negotiate or transmit a fresh, random symmetric key (or key material). This is computationally expensive but only happens once per session.
2. Symmetric phase (Bulk Encryption): All subsequent data in the session is encrypted using the fast symmetric key established in step 1.

This is exactly how HTTPS (TLS) works. The padlock in your browser represents a session that used asymmetric cryptography to bootstrap a symmetric session key, which is now protecting all your traffic.