Blog - How asymmetric encryption works

Asymmetric encryption (public-key cryptography) uses a key pair: a public key (safe to share) and a private key (kept secret). An operation that is easy one way is practically irreversible without the secret.

Intuition

Think of a mailbox with two locks:

• anyone can drop a letter by locking it with the public key,
• only the owner can open it with the private key.

Mathematically we use a one-way function with a trapdoor: $f$ is easy, $f^{-1}$ is hard — unless you know secret $d$.

RSA in short

Pick large primes $p, q$, set $n = pq$, $\varphi(n) = (p-1)(q-1)$. Public exponent $e$ (e.g. $65537$), private $d$ such that:

$$e \cdot d \equiv 1 \pmod{\varphi(n)}$$

Encrypt message $m$ (after proper padding):

$$c = m^{e} \bmod n$$

Decrypt:

$$m = c^{d} \bmod n$$

Security relies in part on the hardness of factoring $n$.

Two main uses

1. Confidentiality — encrypt with the recipient’s public key.
2. Digital signature — sign with the private key; anyone verifies with the public key.

In TLS/HTTPS, asymmetric crypto usually does not encrypt all traffic: it authenticates parties and agrees a session key (AES, etc.), because symmetric crypto is cheaper.

ECDH — agreeing on a secret

With elliptic curves, parties derive a shared secret without sending it. Alice has $a$, Bob $b$, base point $G$:

$$S = a \cdot (bG) = b \cdot (aG)$$

An observer sees $aG$ and $bG$ but cannot recover $S$ without solving the discrete log.

Common pitfalls

1. No padding (raw RSA) — attackable; use OAEP / PSS.
2. Mixed key roles — signing keys ≠ encryption keys (separate pairs / certs in practice).
3. Weak entropy when generating $p,q$ or RNG seeds.
4. Security through obscurity — the algorithm can be public; the secret is the private key.

Takeaway

Asymmetry solves trust bootstrapping (who is who, how to start safely), not bulk data encryption. In production: asymmetric at the handshake + symmetric for the session.