Ravindra BagaleCourses & study guides

33. Cryptography Basics

33.4 Asymmetric Encryption

By Last updated:

Asymmetric (public-key) encryption uses a key pair:

  • the public key can be shared with everyone;
  • the private key is kept secret by the owner.

What one key locks, only the other key opens. So:

You want to Use
Send a secret to Sneha Encrypt with Sneha's public key – only her private key can open it
Prove a message came from you Sign with your private key – anyone checks it with your public key

Algorithms: RSA (2048-bit minimum, 3072+ preferred), ECC such as ECDSA and Ed25519 (smaller keys, same strength), and Diffie-Hellman / ECDHE for agreeing on a shared key over an open network.

Asymmetric crypto is slow, so real systems use it only to exchange or protect a symmetric key, then switch to AES. This mix is called hybrid encryption – it is exactly what TLS and PGP do.

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem
echo "Meeting at Shaniwar Wada 5pm" > msg.txt
openssl pkeyutl -encrypt -pubin -inkey public.pem -in msg.txt -out msg.enc
openssl pkeyutl -decrypt -inkey private.pem -in msg.enc
ssh-keygen -t ed25519        # your SSH keys are the same idea: id_ed25519 (private), id_ed25519.pub (public)

Ravindra Bagale's Tip

A private key is called "private" for a reason – never on email, WhatsApp or GitHub. Students accidentally push the .pem file to a repo. Share the public key; keep the private key only with you, with chmod 400.

Lab

Generate an RSA key pair, give your public.pem to a partner, and ask them to encrypt a short message for you. Decrypt it with your private key. Then explain in two sentences why they could not decrypt their own encrypted message without your private key.