Cryptography - Public Key Encryption

---

---

Transmitting confidential messages via the internet is possible using public key encryption. A public key and a private key are the two keys that the user of this technique applies. While the public key is shared, the private key is kept secret.

For encrypted messages intended to be sent to another client, the client's public key is used for encryption. If the communication is encrypted and can only be decrypted with the receiver's private key, only that person can access it.

This option is important for secure communication when sending sensitive data such as passwords, credit card numbers, or private contacts. Protecting our data from attackers and hackers helps. It is also called as Asymmetric Key Cryptography.

The History of Public Key Encryption

Whitfield Diffie, Ralph Merkle, and Martin Hellman released a paper titled "New Directions in Cryptography" in 1976. They established the first known functional distributed cryptography protocol and presented the concept of public key cryptography in this study. Since then, two mathematically related keys have been used for the public key encryption technique, which is used in finance, e-business, and e-commerce to protect data.

The below figure shows the encryption and decryption procedure −

Components of Public key encrytpion

The following are the Components explained below −

Properties of Public key Encryption

The important properties of a public key encryption scheme are −

• For encryption and decryption, separate keys are used. This characteristic differentiates this system from symmetric encryption schemes.

• Each recipient has a distinct decryption key, also called his private key.

• The recipient must make his public key-an encryption key-public.

• Under order to prevent someone else from acting as the recipient under this method, some assurance of the legitimacy of a public key is required.

• Typically, this kind of cryptosystem involves a reliable third party verifying that a certain public key is unique to a particular individual or organisation.

• Because of the complexity of the encryption technique, an attacker cannot decrypt the plaintext from the ciphertext and the encryption (public) key.

• The secret key cannot be determined from the public key, even with the mathematical link between the public and private keys. In reality, creating a relationship between two keys is the excellent feature of any public-key cryptosystem.

Example of Public key Encryption

Here is a basic example of public key encryption −

Let us say Alice and Bob are two friends. They want to share some private information via the internet. A set of two keys-a public key and a private key-belongs to each of them.

Key Generation − Bob and Alice create their own key pairs. They exchange public keys but keep their private keys confidential.

Sending a secret Message − Alice want to communicate with Bob in private. She uses Bob's public key to encrypt the information. Even if someone intercepts the message, they will not be able to read it without Bob's private key because only Bob's private key can decode that message.

Getting the Message and Decrypting It − Bob gets the message in encrypted form. He reads Alice's original message after decrypting it using his private key. Even though the communication was sent over the internet, it is still secure because only Bob has access to the private key.

In this way, Alice and Bob can have secure communication without having to worry about message hackers. Email encryption, secure chat apps, online banking, and other secure communication channels all make use of public key encryption.

How is public key cryptography used by TLS/SSL?

When it comes to creating secure conversations over the Internet (via HTTPS), public key cryptography can be very helpful. The public key of a website is found in its publicly shared SSL/TLS certificate, whereas the private key is installed on the origin server and is "owned" by the website itself.

Public key cryptography is used during TLS handshakes to exchange data that is needed to generate session keys and to verify the origin server's authenticity. The public-private key pair is used by a key exchange technique, like RSA or Diffie-Hellman, to agree upon session keys, which are then used for symmetric encryption when the handshake is finished. Every communication session can have a fresh session key agreed upon by clients and servers, preventing attackers from decrypting messages even if they figure out or steal one of the session keys from an earlier session.

Public Key Cryptography Algorithms

Here are some common used public key encryption algorithms −

• RSA (Rivest-Shamir-Adleman)

• ElGamal

• DSA (Digital Signature Algorithm)

• ECC (Elliptic Curve Cryptography)

• Diffie-Hellman Key Exchange

These algorithms are used in many encryption protocols and systems to create secure communication and data transmission over the web.

Benefits/Advantages

• No need to share keys − As asymmetric key cryptography is free from the exchange of any keys for decrypting data.

• Proof of ownership − As it links the private and public keys, so the message is decrypted using a private key. It is used as evidence that the message was received from the authorized person, who knows the private key.

• Extended key lengths − Asymmetric encryption methods use up to 4096-bit keys, which significantly enhance the security of ciphertext and ciphers.

• Tamper-proof − If hackers try to change the data while it is being sent, the receiver's private key will not work, letting them know that the message has been modified.

Disadvantages/Vulnerabilities

Let us see some drawbacks of Public Key Encryption now −

• Brute-force attacks can be used against public key encryption.

• When a user loses their private key, this technique also fails, making public key encryption the most sensitive.

• Additionally, public key encryption is vulnerable to man-in-the-middle attacks. Through this attack, a third party can alter the public keys by interfering with the public key transmission.

• A "man-in-the-middle attack" is also possible, making any subordinate certificate completely insecure, if the user private key used to create certificates at a higher level in the PKI (Public Key Infrastructure) server hierarchy is compromised or accidentally revealed. Public key encryption has this flaw as well.

Applications

Asymmetric encryption is not always the best solution, even though it has advantages and disadvantages. It is very helpful for situations where you need to communicate information securely over a network, particularly a public network, and a standard key will not work.

So following are some common applications where Asymmetric cryptography can be used −

• Web Traffic Security − If you see a small lock icon in your web browser's address bar or a web address that begins with "https://" rather than "http://", it shows the website is using an SSL certificate. This SSL certificate is very important since it protects your personal information when you make online purchases. It also helps to ensure that the page you are on is truly who they claim to be, which helps prevent tricks like phishing scams.

• Email Encryption − Most email services use TLS security to secure our emails when we send or receive them. This means that, while your emails are not hidden in your inbox, they are protected from malicious users trying to read them.

• Virtual Private Networks (VPNs) − VPNs are very useful for firms with workers that work from home or around the world. They keep everything safe, confidential, and simple to use. To keep the VPN secure, they use asymmetric encryption, which is similar to TLS or SSL. It helps to make sure that users are who they say they are and protects data as it travels between users and the company's primary system.