What is Asym­met­ric en­cryp­tion?

Asym­met­ric en­cryp­tion (i.e. public key en­cryp­tion or public key cryp­tog­ra­phy), also known as asym­met­ric cryp­tog­ra­phy, is used to protect files, di­rec­to­ries, and entire devices from unau­tho­rized access and to exchange secret messages. This is done by using keys for en­cryp­tion and de­cryp­tion.

Unlike in symmetric en­cryp­tion, users do not share a common secret key (i.e. a private key) in this method. Instead, each user generates their own key pair which consists of a secret or private key and a public key. Any party with the public key can send encrypted data to the owner of the private key, verify their digital signature, and au­then­ti­cate them. In turn, the private key can decrypt the encrypted data, generate digital sig­na­tures, and provide au­then­ti­ca­tion.

In the following, we explain the idea behind asym­met­ric en­cryp­tion, its functions, ap­pli­ca­tions, and potential ad­van­tages and dis­ad­van­tages.

The concept of public key cryp­tog­ra­phy first emerged in 1975 which makes asym­met­ric en­cryp­tion a rather new field in cryp­tog­ra­phy. Cryp­tog­ra­phy itself dates back more than 2,000 years. The main advantage of asym­met­ric en­cryp­tion is also the greatest dis­ad­van­tage of symmetric en­cryp­tion. The com­mu­ni­cat­ing parties do not have to agree on a single shared key. Each party has their own ad­di­tion­al private key.

The problem with a secret key method (symmetric en­cryp­tion) is the key exchange. The secret key must reach the recipient; the more com­mu­ni­cat­ing parties share a key, the more confusing and time-consuming this exchange becomes, thus, making it more unsecure and vul­ner­a­ble.

This makes asym­met­ric cryp­tog­ra­phy a practical al­ter­na­tive since each user has their own key pair.

When using asym­met­ric cryp­tog­ra­phy, each com­mu­ni­cat­ing party has a key pair con­sist­ing of a public key and a private key. Like keys being held together by a keyring, keys in this cryp­tosys­tem are tightly coupled together by a math­e­mat­i­cal algorithm. Data encrypted with the public key can only be decrypted with the private key. It is, therefore, crucial that the private key remains secret from all other com­mu­ni­cat­ing parties to protect the data and ensure that public key cryp­tog­ra­phy is carried out securely.

In practice, the person sending the data will always need the recipient’s public key. The public key has a one-way function in en­cryp­tion. It can encrypt the data, but it cannot then decrypt it. This can only be done by the recipient of the data with their own private key. However, the public key is not just used for en­cryp­tion. It is also used to verify digital sig­na­tures and au­then­ti­cate com­mu­ni­cat­ing parties.

The key is trans­ferred during the initial contact. The private key si­mul­ta­ne­ous­ly generates digital sig­na­tures and can au­then­ti­cate itself to other com­mu­ni­cat­ing parties. In short, asym­met­ric en­cryp­tion allows everyone to access a public key but only decrypt it with the private key. This allows for highly secure data exchange.

To start asym­met­ric en­cryp­tion, the recipient generates a private and a public key. The com­mu­ni­cat­ing partner can access the public key. This simple transfer occurs via a cer­ti­fi­ca­tion authority or a key server where the key has been stored. The sender encrypts their message with the public key and can then send it to the recipient as cipher text. Once this message has been encrypted, it can only be decrypted by the recipient using their private key. Therefore, in principle, you can freely choose which com­mu­ni­ca­tion channel to use; even if the encrypted message is in­ter­cept­ed by an attacker, its contents will remain secret.

This one-way function is the main idea behind the asym­met­ric cryp­tosys­tem. The two keys are com­plete­ly in­de­pen­dent from one another. Even if an attacker has access to the public key, they cannot use it to draw any con­clu­sions about the private key. To ensure this is the case, the public key uses clearly defined prime factors that are mul­ti­plied together and produce an un­am­bigu­ous result. The following is an example of a cal­cu­la­tion the public key might perform:

The private key, on the other hand, works ex­clu­sive­ly with the result of this cal­cu­la­tion (which is 4,577 in this example). It is almost im­pos­si­ble to draw any con­clu­sions about which factors were used to get this value since there are a countless number of pos­si­bil­i­ties for how it could have been reached. To this day, there is still no math­e­mat­i­cal procedure or algorithm that would simplify this reverse cal­cu­la­tion.

Public key cryp­tog­ra­phy is often used for email traffic, such as with the standard en­cryp­tion method S/MIME, for digital sig­na­tures as well as for cryp­to­graph­ic protocols such as SSL/TLS, SSH, and HTTPS.

Asym­met­ric cryp­tosys­tems can also be combined with symmetric methods. In this case, the keys are first exchanged using asym­met­ric en­cryp­tion, but the sub­se­quent com­mu­ni­ca­tion is then encrypted sym­met­ri­cal­ly. This hybrid en­cryp­tion system is used when users want the speed of symmetric cryp­tog­ra­phy but the security of asym­met­ric cryp­tog­ra­phy.

The most popular en­cryp­tion program is probably Pretty Good Privacy, better known as PGP. It is based on public key cryp­tog­ra­phy and is used to encrypt emails. In this case, a public and private key are generated upon in­stal­la­tion. The public key can then either be per­son­al­ly dis­trib­uted or stored in a central database. In this database, anyone can search for keys from specific owners. Using the public key, the sender encrypts their data and labels the email or message as being PGP encrypted. The recipient can then use their private key to decrypt it and make it readable again.

Signature methods are always closely tied to public key cryp­tog­ra­phy. RSA is the best-known method for digital sig­na­tures. A signature is the code con­tain­ing the private key for the message. The sender “signs” their message with RSA and, in this way, adds a layer of security. They can then send the message. The au­then­tic­i­ty of the message and identity of the sender are verified by the recipient using their public key.

RSA is regarded as an old but proven signature method. A couple of al­ter­na­tives that generate and recognize digital sig­na­tures using a similar method are DSA (Digital Signature Algorithm) and ElGamal.

A concrete example of cryp­to­graph­ic protocols is en­cryp­tion with SSL/TLS. This network protocol ensures secure com­mu­ni­ca­tion, such as between the web server and browser. Si­mul­ta­ne­ous­ly, it verifies the server’s au­then­tic­i­ty. To do so, SSL/TLS uses hybrid en­cryp­tion (i.e. both asym­met­ric and symmetric methods). The public key is signed by a cer­tifi­cate authority, and the resulting cer­tifi­cate is encrypted. The cer­tifi­cate can then only be opened by the cer­tifi­cate authority’s public key. To do so, the web server sends its certified public key to the browser, for example, which checks the cer­tifi­cate. If the cer­tifi­cate is valid, the browser generates a symmetric key and sends it to the web server. Both will then use the same shared key for the rest of the SSL/TLS session for the symmetric en­cryp­tion of their data traffic.

The main dis­ad­van­tage of public key cryp­tog­ra­phy is its slow speed of en­cryp­tion. It also requires sig­nif­i­cant­ly more computing power. Therefore, a hybrid system was developed that combines symmetric and asym­met­ric systems, like the pre­vi­ous­ly mentioned example of SSL en­cryp­tion. Previous issues such as unsecure au­then­ti­ca­tion and a high vul­ner­a­bil­i­ty to malware have since been solved by the use of digital cer­tifi­cates and sig­na­tures and ID-based cryp­tosys­tems.

To get the best of both worlds, we recommend hybrid en­cryp­tion. Asym­met­ric cryp­tog­ra­phy handles the task of key dis­tri­b­u­tion. This means you can avoid the cum­ber­some process of dis­trib­ut­ing keys as­so­ci­at­ed with a symmetric cryp­tosys­tem. The result is en­cryp­tion that is fast, secure, and practical.