Home / Knowledge hub / Public key cryptography
Knowledge hub
Public key cryptography
Encryption with a pair of keys: one shared openly, one kept private.
What it means
Public key cryptography, also called asymmetric cryptography, uses two linked keys. The public key can be handed to anyone. The private key never leaves its owner. What one key does, only the other can undo.
That solves an old problem: how do two parties who have never met agree on a secret over an open network? Anyone can encrypt a message to you with your public key, and only you can read it. Reverse the roles and you get a digital signature.
Why it matters
Almost everything you do online rests on it. Certificates for HTTPS, code signing, SSH logins and signed tokens all use key pairs. If the private key is stolen, an attacker can impersonate your site or sign updates as you.
The mathematics is rarely what fails. Keys are copied into repositories, shared in chat, left on build servers or never rotated. A business that cannot say where its private keys live cannot say who could speak in its name.
How it shows up
You meet it in TLS certificates, SSH keys, JWT signing keys, SAML and OAuth setups, and in package signing. Public keys are published; private keys should sit in a vault or a hardware security module.
Mistakes repeat. A private key committed to source control. One key reused across staging and production. A public key accepted from the request itself, so the attacker brings their own. Keys that are never rotated after staff leave. Check where each private key is stored and who can read it.
Questions people ask
Public key cryptography, answered
What is the difference between public key and symmetric encryption?
Symmetric encryption uses one shared key and is much faster. Public key encryption uses a pair and avoids sharing a secret in advance.
In practice they are combined. TLS uses a key pair to agree a shared key, then uses that for the bulk of the traffic.
Which algorithms use public keys?
RSA, elliptic-curve schemes such as ECDSA and Ed25519, and Diffie-Hellman key agreement are the common ones.
Large quantum computers would break many of them, which is why quantum-safe replacements are being standardised.
Is the public key really safe to share?
Yes. It is designed to be public, and knowing it does not let you work out the private key.
What matters is that you have the right public key. A swapped key lets an attacker in the middle, which is why certificates exist.
Where should a private key be stored?
In a secrets manager, a hardware security module or the platform's key service, with access limited to the service that needs it. Never in source control or a shared drive.
Log every use where you can, so unusual signing stands out.
How do we check that keys are handled well?
Search repositories and build output for key material, and confirm that production and test use different keys.
A pentest can also try to reach key files through path traversal, backups or debug endpoints on the running app.
Sources
Where this comes from
Related
Terms that sit next to this one
Symmetric encryption
Encryption where the same secret key locks and unlocks the data.
Digital signature
A value that proves who produced data and that it has not changed since.
HTTPS
The encrypted web protocol, and the minimum for anything with a login.
Hardcoded secret
A password, API key or token written straight into source code.
Key rotation
Replacing a credential on a schedule so a leaked one has a short life.
Where do your private keys live?
Keys in repositories, exposed backups and files reachable through path traversal are inside what we test. In white-box mode a finding can point to the file and line. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.