In a previous blog post we introduced the topic of cryptography, which is a key tool for keeping information secure and private. We used the example of a relatively simple symmetric encryption scheme where the encryption and decryption keys are the same.
Too Many Keys
In symmetric cryptographic systems, two people who wish to communicate need to share a key that is used for encryption and decryption. If you correspond with a lot of other people, however, the number of keys you need increases very rapidly. For example, a group of 10 people wanting to securely communicate in pairs would need a set of 45 keys (we’ll spare you the mathematical details). But what if there was a simpler way to share the keys? What if you could post keys in a public place for anyone to use, without compromising your security or revealing secrets? Asymmetric, or public-key, cryptography lets you do this.
Using Two Keys
Asymmetric cryptography (a relatively new technology from the 1970s) eliminates the secret shared key used by both the sender and recipient and instead uses pairs of keys. When setting up an asymmetric system, each person generates two keys: a private key and a public key. The private key is always kept secure and must remain a secret, while the public key can be given to anyone or posted in public places.
The new feature with this scheme is that the keys are mathematically related—operations done with one key can be undone with the other. So, a message sender can perform encryption using one key and the recipient can perform decryption using the other key. To maintain secrecy, typically the sender will encrypt the message using the public key of the recipient, and the recipient will use their private key to decrypt it. As long as the recipient has access to their private key, they can decrypt messages sent from anyone who uses their matching public key. And the mathematical procedure that is used to create the keys is special so having the public key does not allow someone to learn anything about the private key—making for a very secure system.
Public keys can be published in various places, including specialized key servers that can be searched over the Internet. Individuals and organizations can also publish their keys on their websites or include them in email signatures. Facebook even allows people to publish one kind of public key within their personal profile.
Public Key Certificates
In order to ensure that a public key actually belongs to a certain person or organization, a system of digital certificates (or public key certificates) has been developed. These certificates are electronic documents that typically contain the public key along with information about the owner and an expiry date. It is the job of certificate authorities to confirm the identity of the key owner, and this can be done by checking identification documents or collecting legal paperwork. Certificates used for limited purposes, such as email communications, can often be issued quickly by confirming that the key owner controls that email address (i.e., by replying to a test message). Other certificates may only be issued after confirmation based on a thorough identity check. Digital certificates are used regularly on the Internet to confirm the identity of the owners of the public keys used by email senders and websites that offer secure communications.
Digital Signatures
Public key cryptography is very versatile. Not only can keys be used to encrypt or decrypt a message, they can also be used to authenticate and protect an electronic document. A digital signature can be created by calculating a special mathematic summary of a document and then encrypting that summary using a private key. Anyone with the matching public key can later decrypt the information and view the mathematical summary.
The mathematical summaries are created using special hash functions that have valuable properties. Summaries produced by hash functions are irreversible – there is no calculation that will reproduce the document from the summary information. Hash summaries are also unique, meaning that no two documents will have the same summary, and even a small change to the document will result in a different summary. (We should note that, as computer have become more powerful, some older hash functions have been found to not produce unique summaries and newer functions have to be used.)
The end result is that a digital signature of a document can be used to prove the author of the document (by verifying the ownership of the public key) and the integrity of the document (by verifying that the mathematical summary has not changed). As it turns out, certificate authorities actually sign the digital certificates that they issue to confirm their authorship and to provide assurance that the certificate has not been altered.
Conclusions
Public key encryption, digital certificates, and digital signatures form the backbone of modern electronic security systems. Using these technologies, organizations are able to keep communications secret, verify the identity of different parties, and ensure that documents are authentic and intact. Public key cryptography has enabled a variety of Internet services that require strong security and privacy protections, such as online banking, ecommerce, and government websites.
Suggested Reading
Privacy Tech-Know Blog: Secret Agent 101— Basics of Cryptography
Charles C. Mann, A Primer on Public-key Encryption
Symmetric vs. Asymmetric Encryption – What are (the) differences?