Understanding Asymmetric (Public Key) Cryptography
By: Roderick Graham
Tags: Encryption, Digital Forensics, Cybercrime, Cybersecurity, Cryptography

Photo by Jefferson Santos on Unsplash

Asymmetric cryptography, also called public key cryptography, is an essential element of a secure cyberspace. However, understanding asymmetric cryptography can be challenging for people who are not familiar with computer science or cybersecurity principles. This article is written for the non-techie who wants to understand public key cryptography.

Symmetric Cryptography

When two parties (two people, two computers, two companies, etc.) wish to communicate sensitive information with each other, they will need some way to hide that information as it travels from sender to receiver. One way is to take the original data, which we will call plaintext, and convert it into a message that cannot be understood, which we will call ciphertext. Some type of method is used to make this conversion. It can be as simple as a set of steps “switch the first letter of the word with the last letter of the word,” to a more complex mathematical formula. The process of changing the plaintext into the ciphertext is referred to as encryption.

Once the message has been received by the intended party, that party can convert the ciphertext back to plain text. They must know the original method used to encrypt the message, and then they can reverse the process. The process of changing the ciphertext back to plain text is called decryption.

This process has been around for millennia. Generals going into a battle will know that they will need to communicate sensitive messages across distances. Before a battle, they may agree upon an algorithm for encryption and decryption. During the battle, one general may encrypt his future plans and then ask a courier (on foot, on a horse) to take this message to another general. If the courier is intercepted along the way, the enemy cannot make sense of the message.

Modern computing has made the process of encryption and decryption more complicated, but also easier. Computers use set mathematical algorithms to encrypt data. These algorithms may be known to everyone interested in encrypting messages. A common one is AES (Advanced Encryption Standard), used by the United States Government.

These encryption algorithms incorporate a “key” when encrypting communications. This key is unique to each user, and therefore even if the encryption algorithm is the same, the output of encryption will be different for each user.

This can look visually like this:

Rod’s Key + RSA Algorithm -> encrypt the plain text “Cheese and Crackers” -> into ciphertext “Ecv777*!lll”

Kim’s Key + RSA Algorithm -> encrypt the plain text “Cheese and Crackers” -> into ciphertext “O5deaQm&”

Most discussions about encryption use the example of two fictional people, Alice and Bob. In the figure below, Alice is sending a message to Bob, where the same key is used to encrypt and decrypt the message. Because the same key is used to both encrypt and decrypt a message, this process is called symmetric cryptography.

In sum, symmetric cryptography is an encryption system in which the same key is used to both encrypt and decrypt communications.

Asymmetric Cryptography

But what if Alice and Bob (or our generals) never meet each other to agree upon or exchange keys. How can they communicate securely? To give a real-world example, suppose you are a journalist wanting to get information from a source who lives in another country. The source has knowledge of some injustices in their country. Sending this information by e-mail or through social media applications can be dangerous. They cannot put their information on a USB and send it because that may be intercepted.

To deal with this problem, asymmetric (or public key) cryptography is used.

We can use the same general process as above (Key + Algorithm), except now the key is split into a public key and a private key. You can encrypt a message with the public key and decrypt with the private key!

Here is how the general process would work:

Bob uses an application to generate a public and private key. These keys are together called a key-pair. An example application of a website generating keys is here: https://pgpkeygen.com/.

Bob can then take his public key and “share” it. There are many ways he can do this. He can place his key in spaces that belong to her online — social media accounts, his website, even as a signature in his e-mail address. There are also several public repositories where people have posted their public keys. An example is the OpenPGP key server (http://keys.gnupg.net/). But he keeps his private key secure and no one has access to it.

Alice can find Bob’s public key on his website or a key server, encrypt a sensitive message using Bob’s public key, and then e-mail the message to Bob. Only someone with the private half of the key-pair can then decrypt the message.

So, when Bob receives the message from Alice, he can decrypt the message using his private key.

If the message happens to be intercepted in transit, it cannot be read

Like the symmetric cryptography discussed above, the algorithms used for asymmetric cryptography are widely known. The most widely used, and the one we will use is the RSA (Rivest–Shamir–Adleman) algorithm.

An example of this process is shown below, again using Bob and Alice:

Another aspect of asymmetric cryptography is that it can be used to increase data integrity by ensuring that a message has not been altered in transit.

Let’s say Alice also generates a key-pair. Like Bob, she can keep a secure private key and make her public key available. The key-pairs give Alice the ability to sign a message with this private key, which can then be verified with someone decrypting the message with Alice’s public key. In simple terms, if we believe that only Alice has access to her private key, then any message that can be decrypted with Alice’s public key must come from Alice.

Here is how the general process would work. I will incorporate the previous example of Alice sending an encrypted message to Bob:

Bob generates a key-pair and makes his public key available

Alice wants to send a secure message to Bob, and so she encrypts her message with Bob’s public key

However, she wants Bob to know that her message has not been altered in transit (for example, someone could intercept the message, and delete Alice’s original message and encrypt a new message with Bob’s key)

So, she makes a hash of the (encrypted) message and then encrypts that with her private key. This is called signing a message. Yes, it can be very confusing. A hash function is an algorithm that produces a small series of values from a larger block of data. It is quick and easy to produce a hash, and it does not take up much data space. The two most common hash functions are MD5 (Message Digest 5) and SHA (Secure Hash Algorithm).

of the (encrypted) message and then encrypts that with her private key. This is called a message. Yes, it can be very confusing. A hash function is an algorithm that produces a small series of values from a larger block of data. It is quick and easy to produce a hash, and it does not take up much data space. The two most common hash functions are MD5 (Message Digest 5) and SHA (Secure Hash Algorithm). Alice sends the encrypted hash (encrypted with her private key) and the encrypted original message (encrypted with Bob’s public key) to Bob.

Bob can then decrypt the original message (using his private key) and read it.

He can also check to see if the message was altered in transit. He does this by getting a hash of the decrypted original message. He then decrypts Alice’s hash (using her public key) and then compares the two hashes. If they are the same, they can be sure that Alice’s message was not altered in transit. This is called verification.

A visual example is given below:

Everyday Uses

The use of Alice and Bob are ways of explaining the logic behind both symmetric and asymmetric cryptography. For most people, this process occurs without them even knowing it.

One use example is the Apple iPhone and the automatic encryption of the data on your phone. For someone to read your data, they need your passkey. If law enforcement collects your phone, and you do not give them the passkey, they will have tremendous difficulty reading the data. This is an example of symmetric cryptography.

A second example is HTTPS (HTTP Secure), which uses both symmetric and asymmetric cryptography. Imagine you decide to buy some books from Amazon’s website. When you enter www.amazon.com into the web address, your computer is essentially requesting data from Amazon’s server. There are four steps:

Amazon’s server will send that data along with its public key. Amazon and most companies have had their public key verified by some certificate authority so that we know the key actually belongs to Amazon.

Your browser then generates a separate symmetric key that will be used for the remainder of the connection (session). This symmetric key is encrypted and sent back to Amazon’s servers.

Amazon’s server can decrypt this new key with its private key.

Now the browser and server encrypt their subsequent communications with the symmetric key until the session ends. They have established a secure channel.

These four steps are shown visually below:

Further Reading