Public-Key Encryption Explained

Public-key cryptography is an important part of modern web communication that has made the internet much more secure than a decade ago. The presence of encryption on the web today gives visitors confidence that communication with the webserver is private.

Public-key encryption is utilized by SSL/TLS encryption that is part of the HTTPS (Hypertext Transfer Protocol Security) protocol. As a user, you are most likely accustomed to seeing a lock icon in the URL address bar of your web browser. The little symbol denotes end-to-end encryption, which is what HTTPS is all about. It is a successor to the HTTP protocol that utilizes public-key encryption to transfer data over the internet securely.

It works effortlessly, but there are very complex techniques in play. And that’s what we’ll explain to you. So, keep reading and learn why public-key cryptography is so crucial for security.

What is Encryption?

In simplest, encryption is the processing of converting plaintext into ciphertext. The latter is an unreadable format; it appears as complete gibberish. A message like “Hi, how are you?” would look like “^#4gdw235**&>A” in its encrypted form. The conversion is simply to describe how encryption works, not an actual representation of any cipher.

The strength of the encryption relies on two things: the algorithm and key length. The algorithm or cipher describes the process through which data is manipulated to achieve the encrypted form. And the key length represents how many possible combinations there can be for the key. An encryption key is what can decrypt the data back to its original form, so the stronger the key length, the harder it will be to predict the key and break the encryption.

It should be kept in mind that key length alone is not enough; the cipher in use also determines the difficulty of breaking the encryption.

What is Public and Private Key Encryption?

Public-key encryption is also known as Asymmetric Encryption. It involves a public key and a private key that is used for encryption and decryption purposes.

To understand asymmetric encryption better, it is better to how it differs from symmetric encryption.

Symmetric encryption involves a single key that is used for both encryption and decryption. When two users agree to encrypt a message, they will use a common key to encrypt/decrypt the message. Shared key presents certain challenges. Firstly, both users have to securely share the key with the other user to prevent any third party from obtaining it.

One way is to meet in person and share the key. The other is to send it over the internet, which is very risky because it’s a secret someone monitoring your communication can obtain. Public-key encryption extends a solution by creating a pair of keys, one for encryption and one for decryption.

The public key is accessible to anyone who wishes to communicate with you. The private key is a secret that remains with you. Because the two keys are mathematically linked, the user’s private key can decrypt the encrypted message.

If Sam wants to communicate with Rachel, he will use Rachel’s public key and encrypt the message. Rachel will use her private key to decrypt the message. Once the message has been encrypted with the public key, only the private key can revert it to the original form. It is computationally expensive and almost impossible to guess the private key from the public key. Hence, public-key remains the safest way to exchange data securely over the internet.

How HTTPS Uses Public-Key Encryption

HTTPS is the secure version of the HTTP protocol that has been in use for web communication for decades. The push for HTTPS rose from the need to ensure that communication between the client and the webserver must remain private and secure. As the internet exploded after the proliferation of high-speed internet, more users were coming online than ever before.

It was essential to establish a standard that could lead the transition of the web to be more private. Thus, HTTPS was created.

The HTTPS protocol is based on SSL/TLS encryption which utilizes public-key encryption. When you open a website that uses HTTPS, your device performs an SSL/TLS handshake to verify the authenticity of the webserver. Coming back to the Sam and Rachel example, how can Rachel verify that the message did indeed come from Sam since his public key is available to anyone.

This is where digital signatures come in. Sam would create a hash value, encrypt it using his private key and send it to Rachel. Sam’s public key will be able to decrypt it, thus confirming that the message indeed came from him because it could have only been encrypted by Sam’s private key.

For websites, digital certificates are issued by an entity called a Certificate Authority (CA). There are several Certificate Authorities, such as Global Sign, Sectigo, GoDaddy, and DigiCert. All web browsers recognize these authorities, and they use this list to look up a CA’s identity during the TLS/SSL handshake to verify the website’s legitimacy.

A Certificate Authority does not issue a signature but rather a certificate that contains the signature. So, don’t confuse the two with each other.

Once the webserver has been authenticated, HTTPS moves to symmetric encryption for faster communication because it’s less intensive. The client and webserver will agree on session keys to be used for encrypting the following exchanges during symmetric encryption. To recap, the purpose of HTTPS is to verify the identity of the webserver, then securely exchange session keys for symmetric encryption.

Why Perfect-Forward Secrecy Matters

If someone was monitoring your web activity and storing your messages, all they need is the session that was used to encrypt them. Although it’s not easy to obtain a session key, the potential risk presents itself. Enter Perfect-Forward Secrecy, which seeks to remedy that problem.

Instead of using fixed session keys every time you connect to the web server, the client and webserver will create new keys for every session. A session simply refers to an active state when you are engaging with the webserver. The session closes when you close the website, log out of your account, or a set time expires.

So, even if someone got hold of one session key, it can only decrypt data that was used by that particular session key. The rest of the communication will remain protected.

Always Use HTTPS

Make it a rule never to browse a website that does not feature HTTPS. Thanks to the push by search engines like Google and the collective efforts of everyone involved in providing a web experience, web browsers will notify you when a website is unsecure. Search engines heavily favor websites that use HTTPS.

iProVPN uses AES 256-bit encryption among other security features for protecting your internet communication. It provides another layer of security on top of HTTPS. Moreover, it protects every type of network traffic, not just HTTP/HTTPS.