The Mailbox Analogy
A special mailbox:
- Public slot: Anyone can drop letters in
- Private key: You use the key to open and read them (so keep it private)
People can know where your mailbox is. You keep the key needed to open it.
Public/Private keys work the same way. Someone can encrypt a message to you using your public key. Typically, you need access to the private key to decrypt it.
What Are Public/Private Keys?
Key Pair = Two mathematically linked keys
Public Key:
- Share freely with anyone
- Used to encrypt messages to you
- Used to verify your signatures
Private Key:
- Keep secret (treat it like a password)
- Used to decrypt messages
- Used to sign messages
The Magic
Encrypted with public key → Decrypt with private key
Signed with private key → Verify with public key
Mathematically linked but:
Deriving the private key from the public key is designed to be infeasible.
Encryption vs Signing
Encryption (Confidentiality)
Alice wants to send Bob a secret message:
1. Alice encrypts with Bob's PUBLIC key
2. Bob's PRIVATE key can decrypt
3. After encrypting, Alice typically can't decrypt it without Bob's private key
Anyone can encrypt to Bob (if they have Bob's public key).
Bob is the one who can read it (as long as the private key stays confidential).
Signing (Authenticity)
Bob wants to prove he wrote a document:
1. Bob signs with his PRIVATE key
2. Anyone can verify with Bob's PUBLIC key
3. If it verifies, it strongly suggests Bob's private key created the signature
Someone with Bob's private key can create signatures that verify as Bob.
Anyone can verify.
Both Together
Alice sends secret signed message to Bob:
1. Alice signs with her PRIVATE key
2. Alice encrypts with Bob's PUBLIC key
3. Bob decrypts with his PRIVATE key
4. Bob verifies with Alice's PUBLIC key
Result:
- Bob is the intended reader (encrypted)
- Authenticates as Alice (signed, assuming her private key wasn't compromised)
How It Works
Mathematical Foundation
Based on "hard" math problems:
RSA: Factoring large numbers
Easy: 7 Ă— 11 = 77
Hard: 77 = ? Ă— ? (when numbers are huge)
ECC: Elliptic curve discrete logarithm
Same idea, different math
Smaller keys, same security
Key Generation
1. Generate two large prime numbers
2. Mathematical operations produce:
- Public key (can be shared)
- Private key (should be protected)
Keys are linked but one can't derive the other.
Key Properties
| Public Key | Private Key |
|---|---|
| Share with anyone | Don't share |
| Encrypt messages | Decrypt messages |
| Verify signatures | Create signatures |
| Cannot derive private | Cannot derive public |
| Often a file: id_rsa.pub | Often a file: id_rsa |
Real-World Applications
HTTPS / TLS
When you connect to https://example.com:
1. Server sends its PUBLIC key (in certificate)
2. Browser encrypts session key with server's public key
3. Server can decrypt (has private key)
4. Now both share a secret for fast symmetric encryption
This is how HTTPS establishes encrypted connections!
SSH
Connecting to servers without passwords:
1. Generate key pair (ssh-keygen)
2. Put PUBLIC key on server
3. Login uses PRIVATE key to prove identity
Server: "Prove you have the private key"
Your computer: [signs challenge with private key]
Server: [verifies with public key] → Access granted!
Digital Signatures
Software downloads:
Developer signs with private key
You verify with public key
If signature valid → software is genuine
Contracts:
Legally binding digital signatures
Can't be forged without private key
Cryptocurrency
Wallet address = Public key (receive funds)
Spending = Requires private key signature
Lose private key = Lose access to funds forever!
Email Encryption (PGP/GPG)
Encrypt emails so the intended recipient can read them.
Sign emails to prove they're from you.
Key Sizes
Key sizes are a trade-off:
- Larger keys can increase security but add cost
- Smaller keys can be faster but may not meet modern security expectations
Instead of memorizing numbers, follow current guidance from:
- Your security team
- The service/provider you're using (TLS/SSH/cloud KMS)
- Up-to-date standards your org trusts
Key Management
Protecting Private Keys
Private key compromise = major incident
Store:
- Encrypted on disk (with passphrase)
- Hardware Security Module (HSM)
- Dedicated key management service
Access:
- Minimum people necessary
- Strong access controls
- Audit logs
Key Rotation
Periodically generate new keys:
- Limits damage if old key compromised
- Compliance requirement
- Often recommended in security policies
Backups
Lose private key = Lose access to everything
Backup strategies that protect confidentiality:
- Encrypted backups
- Multiple protected locations
- Test recovery process
Common Mistakes
1. Sharing Private Key
Don't share your private key.
If multiple people/systems need access, use better patterns like role-based access,
service accounts, or a key management system.
2. No Passphrase on Private Key
Private key file without passphrase:
If file stolen → Key stolen
Encrypt private keys with a strong passphrase when your tooling supports it.
3. Committing Keys to Git
Private key in repository = leaked forever!
Use .gitignore, secret managers.
Check: Avoid committing id_rsa, *.pem, *.key
4. Using Weak Keys
Very small/old keys can fall below modern security expectations.
Use current recommendations from your provider or security team.
FAQ
Q: If I lose my private key?
You've lost access to anything protected by it. For SSH, you regenerate and re-add public key. For crypto: funds are gone.
Q: Can public key be kept secret?
It's called "public" for a reason, but not sharing it is fine. It just prevents others from encrypting to you.
Q: How are key pairs related?
Mathematically linked through complex algorithms. But can't derive one from the other in reasonable time.
Q: RSA vs ECC?
ECC is more modern - same security with smaller keys. RSA is more widely supported.
Summary
Public/Private keys enable encryption and digital signatures through asymmetric cryptography.
Key Takeaways:
- Public key: encrypt to you, verify your signatures
- Private key: decrypt, sign (don't share it)
- Powers HTTPS, SSH, signatures, cryptocurrency
- Can't derive private from public
- Use key sizes recommended by current guidance
- Protect private keys with passphrase and protected storage
Public/private keys are a foundation of modern internet cryptography.
Related Concepts
Leave a Comment
Comments (0)
Be the first to comment on this concept.
Comments are approved automatically.