Topic 5.4 Notes – Asymmetric Cryptography

What Asymmetric Cryptography Is

A quick refresher helps here. Plaintext is readable data. Ciphertext is encrypted data. Encryption turns plaintext into ciphertext, and decryption turns it back. A key is the binary value the algorithm uses to do that work.

With asymmetric cryptography, each receiver creates a key pair:

• Public key
  • Shared openly
  • Anyone can use it
• Private key
  • Kept secret
  • Stored securely by its owner

These keys are mathematically related. In AP Cybersecurity terms, they are inverses of each other. If one key does the first operation, only the matching partner key can reverse it.

That solves the big problem from symmetric encryption. You do not need to secretly share one key ahead of time.

The basic flow is straightforward. A sender uses the receiver's public key to encrypt plaintext, and the receiver uses the matching private key to decrypt it.

Asymmetric encryption process

The rule to burn into memory is simple. Public key distributes. Private key stays secret.

The Key Pair Rules

Each entity that wants to receive encrypted data needs its own key pair. So if Dev and Marisol both want two-way confidential communication, each needs a separate pair.

Public and private key handling

• Public key
  • Can be published or sent out
  • Is not treated as secret
• Private key
  • Is never shared with senders
  • Is never published
  • Is the part security depends on

If the private key is compromised

If the private key is exposed, stolen, corrupted, or lost, that pair is no longer trustworthy.

• Generate a new key pair
• Replace the old public key with the new public key
• Retire the old pair completely

A common test trap is thinking new keys fix old damage. They only protect future communication. Data exposed through the old private key stays exposed.

Which Key to Use for Confidentiality

For confidentiality, the direction matters more than anything else.

Correct direction

1. Receiver generates a key pair.
2. Receiver publishes the public key.
3. Sender gets the receiver’s public key.
4. Sender encrypts the message.
5. Receiver decrypts with the matching private key.

So the test rule is:

• Encrypt with the receiver’s public key
• Decrypt with the receiver’s private key

Two-way communication

• Marisol sends to Dev
  → encrypt with Dev’s public key
  → decrypt with Dev’s private key
• Dev sends to Marisol
  → encrypt with Marisol’s public key
  → decrypt with Marisol’s private key

Common mistakes to avoid

• Using the sender’s public key
• Saying “use the public key” without naming whose
• Sharing the private key with the sender
• Encrypting with the private key for confidentiality

That last one connects to digital signatures, which are about proving origin/integrity, not secrecy.

Public key authenticity

A public key must actually belong to the claimed person. If an attacker swaps in their own public key, they can read data meant for someone else. Digital certificates help tie identity to a public key. Detailed PKI stuff is outside this topic’s depth.

Key Length, Keyspace, and Security

For an n-bit key,

$$\text{Keyspace} = 2^n$$

Average random guesses needed:

$$2^{n-1}$$

Every extra bit doubles the keyspace, which makes brute-force guessing much harder.

• Longer keys → more security
• Longer keys → more computation and slower processing

Only compare key lengths within the same algorithm:

• AES-256 is stronger than AES-128
• RSA-4096 is stronger than RSA-2048

Do not compare RSA bit length directly to AES or ECC bit length. That shows up in MCQs a lot.

Common Algorithms and Basic CLI Use

Two common asymmetric algorithms are RSA and ECC. You should recognize them and know they are used for encryption, digital signatures, and digital certificates.

Here’s the basic CLI flow with RSA:

openssl genpkey -algorithm RSA -out receiver_private.pem -pkeyopt rsa_keygen_bits:2048
openssl pkey -in receiver_private.pem -pubout -out receiver_public.pem
openssl pkeyutl -encrypt -pubin -inkey receiver_public.pem -in message.txt -out message.enc
openssl pkeyutl -decrypt -inkey receiver_private.pem -in message.enc -out recovered.txt

This matches the same rule the course keeps testing. The receiver’s public key encrypts. The receiver’s private key decrypts.

In real systems, asymmetric crypto is heavier than symmetric crypto, so they’re often used together. For this topic, you mainly need the key-direction rule.