What is asymmetric encryption?
Asymmetric encryption is encryption with a key pair instead of a single shared key: a public key that can be shared freely, and a private key that never leaves its owner. The two keys are mathematically linked, but in practice the private key cannot be derived from the public one. If someone encrypts a message with your public key, only your private key can unlock it.
It sounds technical, but it solves a very concrete problem: how do you send something confidential to a counterpart you have never exchanged a secret key with? With symmetric encryption, both parties must know the same key in advance. With asymmetric encryption, they do not.
How is the key pair used in practice?
The key pair can be used in two directions, and that gives two different security properties:
- Confidentiality: The sender encrypts with the recipient's public key. Only the recipient's private key can decrypt, so the content is protected in transit.
- Authenticity: The owner signs with their private key, and anyone can verify with the public one. That is the principle behind a digital signature and code signing.
Then there is key exchange: asymmetric encryption is used to securely agree on a symmetric key, which then encrypts the actual traffic. That is how TLS works every time you see the padlock in your browser.
RSA, elliptic curves and the quantum threat
The two dominant algorithm families are RSA, which relies on the extreme difficulty of factoring very large numbers, and elliptic curve cryptography (ECC), which provides the same security with far shorter keys and is therefore used more and more.
Both share the same weakness, however: a sufficiently powerful quantum computer will be able to break them. That is why NIST has standardised new quantum-resistant algorithms, and the EU has set a deadline for migrating critical infrastructure. Read more under quantum cryptography and harvest now, decrypt later.
Where does your business encounter asymmetric encryption?
Everywhere, typically without thinking about it: the padlock on your website and webshop (TLS certificates), signed documents and MitID (the Danish national digital ID), signed software, secure email with PGP or S/MIME, VPN connections and machine-to-machine communication. The system that binds public keys to identities via certificates is called PKI, and that is where things most often go wrong in practice: expired certificates, poorly protected private keys and a lack of overview.
How MI Support IT can help
We work with asymmetric encryption where it has to be operated: PKI management with control of certificates, keys and renewals, protection of private keys with an HSM and advice on quantum-safe migration, as part of your overall IT security. If you want an overview of your certificates and keys, contact us or download the e-book PKI and HSM in practice.