# Understanding Private-Public Key Encryption

> **Source:** [http://localhost:1313/private-public-key-encryption/](http://localhost:1313/private-public-key-encryption/)
> **Author:** [Vikash Patel](https://vikashpatel.net)
> **Published:** November 06, 2025
> **Reading Time:** 6 min
> 
> *This is the raw Markdown source of the article from the [Lorbic Technical Journal](http://localhost:1313/).*

---


In today's digital world, where secure communication, authentication, and data integrity are non-negotiable, **private-public key encryption** (also called *asymmetric cryptography*) plays a foundational role. From HTTPS in your browser to SSH logins, cryptocurrency wallets, and email encryption, this elegant cryptographic system enables trust without prior shared secrets.

In this blog, we'll dive into:
- The core concepts behind asymmetric encryption
- How it differs from symmetric encryption
- The mathematics (intuitively explained) behind popular algorithms like RSA and ECC
- Real-world examples and code snippets
- Common use cases and pitfalls

Whether you're a curious beginner or a seasoned developer brushing up on fundamentals, you'll find something valuable here.

## A Quick Comparison of Symmetric vs. Asymmetric Encryption

Before we dive into public-key crypto, let's contrast it with its older sibling: **symmetric encryption**.

| Feature                | Symmetric Encryption          | Asymmetric Encryption             |
|------------------------|-------------------------------|-----------------------------------|
| Keys                   | One shared secret key         | Two keys: public + private        |
| Speed                  | Fast                          | Slower (computationally heavy)    |
| Key Distribution       | Hard (needs secure channel)   | Easy (public key can be shared)   |
| Use Cases              | Bulk data encryption (e.g., AES) | Key exchange, digital signatures |

**Symmetric encryption** (like AES) is great for encrypting large amounts of data quickly, but you need a way to **securely share the secret key** beforehand. That's where **asymmetric encryption** shines: it solves the *key distribution problem*.

## Two Keys, One Mathematical Bond

In asymmetric cryptography:
- The **public key** is shared openly.
- The **private key** is kept secret.
- Data encrypted with one key can **only** be decrypted with the other.

This creates two powerful capabilities:
1. **Confidentiality**: Encrypt with someone's *public key* → only they can decrypt with their *private key*.
2. **Authentication & Integrity**: Sign data with your *private key* → anyone can verify it using your *public key*.

> **Crucial Insight**: The public key *cannot* be used to derive the private key, even though they're mathematically linked. This is the "hard problem" that makes the system secure.


## How It Works

### Example 1: Sending a Secure Message

Alice wants to send a confidential message to Bob.

1. Bob generates a key pair:  
   - Public key: `Bob_pub`  
   - Private key: `Bob_priv` (kept secret)
2. Bob shares `Bob_pub` with Alice (e.g., via email, website, key server).
3. Alice encrypts her message using `Bob_pub`.
4. Bob receives the ciphertext and decrypts it with `Bob_priv`.

Even if Eve intercepts the message and has `Bob_pub`, she **cannot** decrypt it, because the private key is required.

### Example 2: Digital Signatures

Now, Alice wants to prove a message truly came from her.

1. Alice hashes her message → `H = SHA256("Hello Bob!")`
2. She encrypts the hash with her *private key*: `Sig = Encrypt(H, Alice_priv)`
3. She sends both the message and `Sig` to Bob.
4. Bob:
   - Hashes the received message → `H'`
   - Decrypts `Sig` using `Alice_pub` → gets `H`
   - Checks if `H == H'`

If they match, the message is **authentic** and **unchanged**.

> Note: In practice, we don't encrypt the whole message, just its hash (for efficiency and security).

## Under the Hood: RSA and ECC

Two major algorithms power most public-key cryptography today:

### 1. RSA (Rivest–Shamir–Adleman)

**Based on**: The difficulty of factoring large prime numbers.

#### Key Generation (Simplified):
1. Choose two large primes: `p` and `q`
2. Compute `n = p * q`
3. Compute Euler's totient: `φ(n) = (p-1)(q-1)`
4. Choose public exponent `e` (commonly 65537) such that `1 < e < φ(n)` and `gcd(e, φ(n)) = 1`
5. Compute private exponent `d` such that `(d * e) mod φ(n) = 1`

- Public key: `(n, e)`
- Private key: `(n, d)`

**Encryption**:  
`ciphertext = plaintext^e mod n`

**Decryption**:  
`plaintext = ciphertext^d mod n`

> RSA requires large keys (2048+ bits) for security today.

#### Python Example (using `cryptography` library):

```python
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives import serialization


# Generate keys
private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = private_key.public_key()

# We are writing the keys to files for demonstration purposes
with open("public_key.pem", "wb") as f:
    f.write(public_key.public_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PublicFormat.SubjectPublicKeyInfo
    ))

with open("private_key.pem", "wb") as f:
    f.write(private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption()
    ))

# Encrypt
message = b"Secret message"
ciphertext = public_key.encrypt(
    message,
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None
    )
)

# Decrypt
plaintext = private_key.decrypt(
    ciphertext,
    padding.OAEP(
        mgf=padding.MGF1(algorithm=hashes.SHA256()),
        algorithm=hashes.SHA256(),
        label=None
    )
)

print(plaintext)  # b"Secret message"
```

### 2. ECC (Elliptic Curve Cryptography)

**Based on**: The algebraic structure of elliptic curves over finite fields. A type of math involving curved lines and numbers that reset after a certain point, designed so that going forward is easy, but going backward without a secret key is practically impossible. 

- Offers **same security as RSA** with **much smaller keys** (e.g., 256-bit ECC ≈ 3072-bit RSA).
- Faster and more efficient, ideal for mobile and embedded systems.

Common curves: `secp256k1` (used in Bitcoin), `Curve25519` (used in Signal, SSH).

#### ECC Key Generation (Conceptual):
1. Choose a standard elliptic curve (e.g., `secp256r1`)
2. Pick a random private key `d` (a large integer)
3. Compute public key `Q = d * G`, where `G` is a known base point on the curve

The security relies on the **Elliptic Curve Discrete Logarithm Problem (ECDLP)**: given `Q` and `G`, it's computationally infeasible to find `d`.

> ECC is now the **preferred choice** for new systems (TLS 1.3, blockchain, etc.).


## Real-World Use Cases

### 1. **TLS/SSL (HTTPS)**
- Your browser uses the server's public key to establish a secure session.
- Asymmetric crypto exchanges a symmetric key (e.g., AES) for efficient data transfer.

### 2. **SSH Authentication**
- Your SSH client proves identity using a private key; the server verifies with your public key.

### 3. **PGP/GPG Email Encryption**
- Encrypt emails with recipient's public key; sign with your private key.

### 4. **Cryptocurrencies**
- Bitcoin wallet addresses are derived from public keys.
- Transactions are signed with private keys to prove ownership.


## Common Pitfalls & Best Practices

| Mistake | Why It's Bad | Best Practice |
|--------|-------------|---------------|
| Reusing RSA keys for encryption + signing | Increases attack surface | Use separate keys or follow PKCS standards |
| Using small key sizes (e.g., 1024-bit RSA) | Vulnerable to factorization | Use ≥2048-bit RSA or 256-bit ECC |
| Not using padding (e.g., textbook RSA) | Vulnerable to chosen-ciphertext attacks | Always use OAEP (encryption) or PSS (signing) |
| Hardcoding private keys in code | Massive security risk | Store in secure vaults (e.g., HashiCorp Vault, AWS KMS) |


---

Private-public key encryption is not just a cryptographic curiosity, it's the **trust engine** of the internet. By elegantly solving the key distribution problem, it enables secure communication between strangers across an insecure network.

While the math behind RSA and ECC can seem daunting, modern libraries abstract away the complexity. As a developer, your job isn't to implement these algorithms from scratch, but to **use them correctly**, respect key hygiene, and understand their limits.

As you explore steganography or other low-level projects (like embedding data in media), remember: **encryption protects content, steganography hides its existence**, and the two can even work together!


## Further Reading

- [PKCS Standards](https://en.wikipedia.org/wiki/PKCS?ref=lorbic.com)
- [NIST Guidelines on Key Management](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final?ref=lorbic.com)
- [Serious Cryptography by Jean-Philippe Aumasson](https://nostarch.com/serious-cryptography-2nd-edition?ref=lorbic.com)
- [Cloudflare's ECC explanation](https://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/?ref=lorbic.com)

---

**Got questions or want a deep dive into a specific algorithm?** Leave a comment below!

Happy encrypting!