[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.4.c
AP Cybersecurity · Securing Applications and Data
Applying Asymmetric Encryption
Encrypt with the public key, decrypt with the private one — which is why the public half can be published.
key ideaEncrypt with the public key, decrypt with the private one — which is why the public half can be published.
The syntax
Common asymmetric algorithms are RSA and elliptic curve cryptography (ECC). They appear in digital signatures and digital certificates as well as in file encryption — and, as with symmetric encryption, the work can be done from a command line, specialized software, or web-based tools.
| Symmetric | Asymmetric |
|---|
| keys | one, shared | a pair — public and private |
| encrypting | with the shared key | with the public key |
| decrypting | with the same key | with the private key |
| distribution | the key must reach the other party safely | the public key can be published |
| typical algorithms | AES | RSA, ECC |
| other uses | — | digital signatures, digital certificates |
Row 4 is why asymmetric encryption exists. The key distribution problem disappears when one half of the pair can be handed to anyone — and that is what makes certificates and signatures possible.
generating a 2048-bit RSA key pairthe private key, then the public half extracted from it
$ openssl genpkey -algorithm RSA -out rsa.pem \
-pkeyopt rsa_keygen_bits:2048
$ openssl rsa -in rsa.pem -pubout -out rsa_public.pemgenpkeygenerates a private key-algorithm RSARSA — one of the two common asymmetric algorithmsrsa_keygen_bits:2048a 2048-bit key — the key length decision-out rsa.pemthe private key file — protect this one-puboutextracts the public half, safe to distribute
Doing it step by step
1
Generate the key pair
One command produces the private key; a second extracts the public half from it. The pair is generated together and belongs together.
in a key length out two files
2
Protect the private key
It decrypts everything encrypted to you. If it leaks, the pair is finished — and unlike a password, it cannot be quietly rotated without redistributing the public half.
out a stored, restricted file
3
Distribute the public key
To anyone who needs to send you something. Publishing it is safe by design — that is what makes the model useful.
out a shared public key
4
Encrypt with the public key
The sender uses your public key. From that moment only your private key can recover the plaintext — including for the sender.
out ciphertext only you can read
5
Decrypt with the private key
The same tool, with the private key and the decrypt flag.
out the plaintext
encrypting and decrypting a filepublic key in, private key out
$ openssl pkeyutl -encrypt -inkey rsa_public.pem -pubin \
-in test.txt -out test_encrypted.dat
$ openssl pkeyutl -decrypt -inkey rsa.pem \
-in test_encrypted.dat -out test_decrypted.txt-encrypt -inkey rsa_public.pemencryption uses the public key-pubintells the tool the supplied key is a public one-decrypt -inkey rsa.pemdecryption uses the private keythe asymmetrythe sender cannot decrypt what they just encrypted — only the key holder can
Worked analysis
EX 1
Which key goes where?
A colleague wants to send you an encrypted file. Which key do they need, and which do you keep?
1
Identify what they must do
Encrypt — so they need your public key.
2
Note what that costs you
Nothing. The public key is safe to publish.
3
Identify what you must do
Decrypt — with your private key, which never leaves your control.
4
Note the consequence for the sender
Once sent, even they cannot read it back — only your private key can.
5
Contrast with symmetric
No shared secret had to travel anywhere, which is precisely the problem AES leaves unsolved.
EX 2
Read the generation command
Explain openssl genpkey -algorithm RSA -out rsa.pem -pkeyopt rsa_keygen_bits:2048.
1
The subcommand
genpkey generates a private key.
2
The algorithm
-algorithm RSA — RSA, alongside ECC, is one of the common asymmetric choices.
3
The output
-out rsa.pem — the private key file.
4
The key length
rsa_keygen_bits:2048 — a 2048-bit key.
5
The missing half
The public key is extracted afterwards with -pubout. Generation produces the private key; the public one is derived from it.
EX 3
Where asymmetric encryption is really used
Asymmetric encryption is slower than symmetric. Why is it everywhere?
1
State the speed fact
Asymmetric operations are slower than symmetric ones.
2
State what it uniquely solves
Key distribution — the public half can be handed to anyone.
3
Name the applications
Digital signatures and digital certificates, both of which depend on that asymmetry.
4
Describe the common pattern
Use asymmetric encryption to exchange a symmetric key, then use the fast symmetric cipher for the bulk data.
5
State the division of labor
Asymmetric for establishing trust, symmetric for moving volume.
Verify the result
four checks
- Confirm you encrypted with the public key and decrypted with the private one.
- Check the private key file is restricted — it is the whole security of the pair.
- Decrypt and compare with the original before discarding the plaintext.
- For bulk data, expect the real design to be asymmetric to exchange a key, symmetric for the data.
Check yourself
Name two common asymmetric algorithms and two applications.
Show answer
RSA and elliptic curve cryptography (ECC); they are used in digital signatures and digital certificates, among other applications.
Which key encrypts, and which decrypts?
Show answer
The public key encrypts; the private key decrypts. That asymmetry is what makes publishing the public half safe.
How can asymmetric encryption be performed?
Show answer
As with symmetric encryption — using the command line, specialized software, or web-based tools.
What does the command generating a key pair produce first?
Show answer
The private key. The public half is extracted from it afterwards — the pair is generated together and belongs together.