Tool 4 of 8

Asymmetric encryption

Each person has a key pair: a public key that anyone may know and a private key that never leaves its owner. What is encrypted with someone's public key can only be decrypted with their private key.

Your challengeAlice and Bob have never met and share no secret. Find out how Alice can still send Bob a message that only he can read, even though Eve sees everything.
Visualise

A public key to lock, a private key to unlock

Genuine RSA-OAEP Simulated network
Alice
sender
Network Simulated
Eve
sees everything public
Bob
receiver

Analogy: Bob hands out open padlocks (public key). Anyone can snap one shut on a box. Only Bob has the key that opens them (private key).

Experiment

Encryption lab

Genuine RSA-OAEP 2048-bit
Generating four key pairs… RSA keys take a moment.

Public key directory (anyone can read it)

Alice writes
and encrypts for one recipient
Encrypt for:
Ciphertext
(nothing encrypted yet)
Who can decrypt it? Each person tries with their own private key.

Try this

What happened

    Explain

    Key ideas

    A key pair

    The two keys are generated together and belong together. What one key locks, only the other can unlock. You cannot compute the private key from the public key.

    Public key: share it

    public Publish it on a website, send it by e-mail, print it on a card. Everyone, even Eve, may have it.

    Private key: never share it

    private It stays with its owner. If it leaks, everything encrypted for that person can be read.

    Encrypt for someone

    To send Bob a secret, use Bob's public key. Only Bob's private key decrypts it. Not even the sender can decrypt it afterwards.

    Solves key distribution

    No shared secret is needed in advance. Bob can publish his public key openly: knowing it does not help Eve decrypt.

    Slow and size-limited

    RSA is much slower than AES and can only encrypt a few hundred bytes (190 bytes with the 2048-bit key here). That is why real systems use hybrid encryption.

    Common misconceptions

    "Asymmetric encryption and digital signatures are the same thing."
    Both use key pairs, but for different goals. Encryption hides content from everyone except the private-key holder. A signature proves who wrote something (Tool 7).
    "I encrypt with my own private key to send a secret."
    To keep a message confidential, you always use the recipient's public key.
    "The public key must be kept secret too."
    No. The real question is a different one: is this public key really Bob's? That is the job of certificates (Tool 8).

    Public-key cryptography has several uses

    Encryption

    Lock with the recipient's public key, unlock with their private key. This tool.

    Key agreement

    Two parties derive a common secret from each other's public values. Tool 6.

    Digital signatures

    Sign with your private key, others verify with your public key. Tool 7.

    Apply

    Where you meet asymmetric encryption

    Encrypted e-mail

    PGP and S/MIME encrypt messages for the recipient's public key (combined with symmetric encryption, see Tool 5).

    SSH keys

    When you run ssh-keygen, you create a key pair. The public key goes on the server, the private key stays on your computer. (SSH uses it for authentication, not for encrypting data.)

    Protecting keys

    Asymmetric encryption is mostly used to protect a small symmetric key, which then protects the real data.

    Challenges

    1. Which key?

    Charlie wants to send a confidential message to Bob. Which key does Charlie use? Which key does Bob use?

    Show answer
    Charlie encrypts with Bob's public key. Bob decrypts with Bob's private key. Charlie's own keys play no role.
    2. Eve has everything public

    Eve has every public key and every ciphertext. In the lab, let Eve try to decrypt. Why does she fail?

    Show answer
    Decryption needs Bob's private key. The public key only encrypts. Eve's own private key belongs to a different pair and cannot open Bob's messages.
    3. The long message

    Try to encrypt a 300-character message. What happens, and how do real systems solve it?

    Show answer
    The browser refuses: RSA-OAEP with a 2048-bit key can encrypt at most 190 bytes. Real systems encrypt the data with a fast symmetric key and only encrypt that key with RSA: hybrid encryption (Tool 5).

    Continue the journey