Asymmetric Encryption and Key Pairs

Asymmetric encryption (also called public-key cryptography) uses mathematically linked key pairs: a public key that can be freely distributed, and a private key that must be kept secret. Data encrypted with the public key can only be decrypted with the corresponding private key — and vice versa. This elegant design solves the key distribution problem of symmetric encryption: you can share your public key openly without compromising security, because only your private key can decrypt messages sent to you.

RSA (Rivest-Shamir-Adleman) is the most widely deployed asymmetric encryption algorithm, invented in 1977. Its security relies on the mathematical difficulty of factoring the product of two large prime numbers. RSA supports key lengths of 1024, 2048, and 4096 bits — 2048-bit RSA is the current minimum recommendation, with 4096-bit for long-term security. RSA is used for key exchange in TLS (though increasingly replaced by ECDHE), digital signatures in certificates, and S/MIME email encryption.

Elliptic Curve Cryptography (ECC) achieves equivalent security to RSA using much shorter key lengths. A 256-bit ECC key provides security comparable to a 3072-bit RSA key. This efficiency makes ECC ideal for resource-constrained environments like mobile devices, IoT hardware, and TLS connections where performance matters. ECC relies on the mathematical difficulty of the elliptic curve discrete logarithm problem. Common ECC algorithms include ECDSA (Elliptic Curve Digital Signature Algorithm) and ECDH (key exchange). TLS 1.3 requires ECC-based key exchange.

Understanding the direction of key usage is critical for the Security+ exam. There are two distinct use cases that reverse the key roles. For encryption for confidentiality: the sender encrypts with the recipient's public key, and only the recipient can decrypt with their private key. For digital signatures for authentication: the signer encrypts the hash with their own private key, and anyone can verify using the signer's public key. Getting these directions backwards is a common exam mistake — remember: public key encrypts, private key decrypts; private key signs, public key verifies.

Digital signatures use asymmetric cryptography to provide authentication, integrity, and non-repudiation. The process is: (1) the sender computes a hash of the message, (2) encrypts the hash with their private key to create the signature, (3) sends the message and signature together. The receiver: (4) decrypts the signature using the sender's public key to recover the hash, (5) independently hashes the received message, and (6) compares the two hashes — a match proves the message is authentic and unaltered.

Asymmetric encryption is computationally expensive compared to symmetric encryption — typically 100 to 1000 times slower. This is because asymmetric algorithms perform complex mathematical operations (modular exponentiation for RSA, point multiplication on curves for ECC) on large numbers. For this reason, asymmetric encryption is never used to encrypt bulk data directly. Instead, it is used to securely exchange a small symmetric session key, and the symmetric key then encrypts the actual data. This hybrid approach combines the security advantages of both approaches.

Proper key pair management is essential. Private keys should be generated in a Hardware Security Module (HSM) or kept in an encrypted key store, never stored as unprotected plaintext files. Key pairs have a limited validity period, after which they must be regenerated. For certificate-based key pairs, the private key must never leave the device or HSM it was generated on. Compromise of a private key means an attacker can impersonate the key owner and decrypt all messages encrypted with the corresponding public key.

Asymmetric key pairs only provide security if you can trust that a public key actually belongs to whom you think it does. Without a trust mechanism, an attacker could substitute their public key for your intended recipient's key — a classic man-in-the-middle attack. Public Key Infrastructure (PKI) solves this by having a trusted Certificate Authority (CA) digitally sign a certificate that binds a public key to a verified identity. When you visit an HTTPS website, your browser verifies the server's certificate against a CA it trusts, confirming the public key is legitimate.

When choosing between RSA and ECC, consider three factors. Key size efficiency: ECC 256-bit = RSA 3072-bit in security. Performance: ECC is significantly faster, especially on mobile and IoT devices. Adoption: RSA has broader legacy support; ECC is required in TLS 1.3 and increasingly mandated by modern security standards. Both algorithms are still considered secure when properly implemented with current recommended key sizes. The Security+ exam expects you to know these trade-offs and when each is appropriate.

Asymmetric encryption faces a long-term threat from quantum computers. Shor's algorithm, when run on a sufficiently powerful quantum computer, can solve the factoring problem (breaking RSA) and the discrete logarithm problem (breaking ECC) in polynomial time — making currently secure key sizes breakable. NIST has already selected post-quantum cryptographic algorithms including CRYSTALS-Kyber (key encapsulation) and CRYSTALS-Dilithium (digital signatures) to replace RSA and ECC. Organizations handling data with long-term sensitivity should begin planning for post-quantum migration now.

Asymmetric encryption underpins many of the security mechanisms you use every day. HTTPS: the TLS handshake uses RSA or ECC to exchange session keys. SSH: public key authentication replaces passwords with key pairs. Code signing: software vendors sign their code with private keys; your OS verifies with the public key. S/MIME email: encrypt email with recipient's public key and sign with your private key. Bitcoin/blockchain: transactions are signed with ECDSA private keys. Understanding where these mechanisms appear in practice helps contextualize exam questions.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: asymmetric encryption uses mathematically linked key pairs; RSA and ECC are the dominant algorithms (ECC is faster with shorter keys); public keys encrypt for confidentiality and private keys sign for authentication; and asymmetric encryption is slow but solves key distribution. Next up we explore Hashing and Data Integrity.