Asymmetric encryption is an advanced form of cryptography where the key used to encrypt data is distinct from the key used to decrypt it on the receiving end of the interaction. With asymmetric encryption, anyone can use a recipient’s public key to encrypt a message. However, once encrypted, only the holder of the intended recipient’s private key can decrypt it. Email messages, SSL certificates, and cryptocurrency transactions all use asymmetric encryption for highly secure electronic interactions.
In this article, we’ll overview how encryption has been used historically and the role of symmetric encryption. We’ll then look at how asymmetric encryption overcame the most pressing challenge that older symmetric encryption methods faced. We will also learn how asymmetric encryption uses public/private key pairs and digital signatures to enhance security. Finally, we’ll highlight some of the most widely-known asymmetric encryption algorithms.
What Is Symmetric Encryption?
Encryption is the process of transforming information into a code or cipher, such that only authorized parties will be able to decrypt and understand it. The encrypted information transmitted should be unintelligible to unauthorized parties.
Symmetric encryption is the most basic type of encryption. With this form of cryptography, the key used to transform a message from plain text into an encrypted format is the same key that must be used to decrypt the message back into a readable format. In other words, the sender and recipient both share one cipher, also known as a secret key or private key, to encrypt and decrypt information. Since the encryption and decryption process is the exactly same on both sides of the interaction, this form of cryptography is called symmetric encryption.
Let’s look at an example of symmetric encryption and examine the limitations of this encryption technique.
Caesar Cipher
Caesar Cipher is a basic and widely-known form of symmetric encryption. It is named after Julius Caesar, who is said to have used the cipher in his private correspondence during the 1st Century BC.
A Caesar Cipher is basically just a simple shift in an ordinary alphabet. To create a Caesar Cipher, one simply rotates the alphabet a few places to the left or right. For example, we can create a cipher alphabet that shifts letters five places to the right. The result would look like this.
Normal Alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher Alphabet: VWXYZABCDEFGHIJKLMNOPQRSTU
If we wanted to write an encrypted message to say “Blockchain,” our message would simply be written as “Wgjxfxcvdi” using the cipher alphabet. Anyone who has access to the cipher alphabet can easily decrypt the message by rotating each letter five places to the right, resulting in a return to the plain alphabet.
Although the Caesar Cipher was innovative in the time of the Roman Empire, it’s clear that any unauthorized person who intercepts the message could guess the pattern necessary to decrypt the message without having access to the cipher (private key). At the very most, this would only take 26 attempts. Since the goal of encryption is to make sure that only the authorized sender and recipient are able to decrypt the message, this encryption technique quickly falls apart.
The Private Key Exchange Problem
One of the biggest challenges for symmetric encryption is the private key exchange problem. The security of the encrypted messages depends on only authorized users having access to the private key required for decryption. However, this presents a problem. How can two or more parties agree upon a private key if they are unable to meet face-to-face?
Before the internet existed, this meant that someone— a trusted courier, for example— was responsible for delivering the private key from one party to the other. Of course, the private key itself couldn’t be encrypted. With no private key yet established, any form of encryption would be indecipherable to the recipient, even if they were a close ally. As a result, the trusted courier would need to transfer the private key in a plain text format. This presented the possibility of an unauthorized party gaining access to the private key. After all, adversaries could bribe or bruise the courier into giving up the private key.
The problem no longer exists in today’s digital world, thanks to more advanced cryptographic techniques like asymmetric encryption and public key cryptography. We’ll explain this in more detail shortly. It’s just important to note that symmetric encryption, no matter how complex the private key and encryption may be, is not considered secure due to the private key exchange problem.
Movement To Modernize Cryptography
Before the 1970s, only symmetric encryption existed. Even when the cryptographic techniques being implemented were more advanced than a simple Caesar Cipher, the private key exchange problem made secure communication extremely precarious. In cases where the private key had to be distributed to larger groups of people throughout the world, it was even more difficult to prevent unauthorized parties from intercepting the private key.
Additionally, if the private key was compromised, all authorized parties would need to be sent a new one. Once again, this meant the problem continued. Cryptographers realized that a better solution was needed for encrypting and decrypting messages. This led to a movement among cryptographers to develop a new form of encryption called asymmetric encryption.
What Is Asymmetric Encryption?
Asymmetric encryption is a form of encryption in which authorized parties use one key to encrypt information (called the public key) and a distinct key to decrypt information (known as the private key). Stated differently, decryption is the inverse operation of encryption.
With asymmetric encryption, authorized parties either independently derive a shared private key, as with Diffie-Hellman key exchange, or each individual simply has their own private-public key pair, as with public key cryptography. In both cases, two individuals never need to exchange a private key, as they do with symmetric encryption.
Public And Private Keys
Each person who uses asymmetric encryption has a unique private key. Once a private key is established, it is used to determine what’s known as the public key. Every private key corresponds to exactly one public key, hence the phrase “private-public key pair.”
Unlike symmetric encryption, private key exchange isn’t necessary. In fact, the security of asymmetric encryption relies upon each individual being the only person who has access to their own private key. The public key, on the other hand, can be shared with anyone. While each private key is used to derive precisely one public key, it is impossible to determine the private key from knowledge of the public key.
With older asymmetric encryption techniques like Diffie-Hellman key exchange, the public keys are exchanged between two individuals and used to derive a shared private key. Each person’s private key still remains secret to them and it’s still safe to share the public key with anyone.
With newer asymmetric encryption methods, such as elliptic curve cryptography (ECC) and digital signature algorithms, the public keys themselves are used to encrypt information. Then only the intended recipient can decrypt that information using their corresponding private key. The public keys essentially act as opened combination locks— you don’t need to know the combination to use it to lock or encrypt a message. Once locked shut, only the person who knows the combination— that is, the private key— can open the lock and retrieve the contents.
In both circumstances, the private key exchange problem is avoided with asymmetric encryption. It’s no longer necessary for two parties to send a private key in plain text.
Digital Signatures
A message being sent via asymmetric encryption relies upon the use of a digital signature. Similar to how a handwritten signature is used to represent a person’s identity for physical documents (e.g. contracts, checks, etc.), a digital signature serves a similar purpose for digital documents. While a handwritten signature can be forged with relative ease, a digital signature is designed to be used only once and can’t be counterfeited. Although digital signatures are backed by complex algorithms, the purpose of this technology is quite simple.
Whenever someone wants to send a message using asymmetric encryption, this person (the sender) must present a public key and the matching private key. The issue is that the private key needs to be verified somehow without being publicly broadcasted. After all, the private key must remain private. At the same time, the private key must somehow be included in the signature so that the recipient can verify the identity of the sender.
A digital signature is essentially a secure way of saying “I am who I say I am, and here’s the mathematical proof to confirm this fact.” Only the person who has access to the specific private key belonging to the corresponding public key can produce a digital signature from that key pair. While we don’t actually have to know the name of the person who owns the key pair to create a digital signature, we are able to verify the public key from which the message has been sent.
Learn more about Digital Signatures in this overview.
Asymmetric Encryption Example
Alice wants to send a secure message to Bob. In order to send the message, Alice must first be able to identify how to contact Bob. With asymmetric encryption, the sender of a message (Alice) needs to know the public key of the recipient (Bob). It’s important to note that the recipient (Bob) might know Alice’s public key but doesn’t necessarily have to know it in order to receive a message from her. In this case, let’s say that Bob does know Alice’s public key and is expecting a message from her.
After Alice learns Bob's public key, she can use it to encrypt her message and send it to Bob. Her plain text message is run through a cryptographic hash function, which deterministically produces a fingerprint for that particular string of text. This fingerprint is then used as one component of the digital signature so that Bob knows the message hasn’t been tampered with. Using her private key, and a few other components, Alice creates a unique digital signature for this specific message. Alice is the only one with access to her private key, so Bob will know that the message could only have come from her.
Using his private key, Bob is able to decrypt Alice's message. Note that only Bob’s private key can decrypt messages that have been encrypted with his public key. In this way, the message is “for his eyes only.” Further, Bob knows that the message must have been sent from Alice because, as stated earlier, Bob knows Alice’s public key and can see that her public key is attached to the message. The unique digital signature created for the message also verifies that Alice signed the message with her private key.
Overview of Popular Asymmetric Encryption Algorithms
Asymmetric encryption algorithms, also known as digital signature schemes, form the basis of secure communication using public keys and private keys. Let’s compare a few popular algorithms that have historical or current significance in the era of modern encryption.
Diffie-Hellman
Published in 1976, the Diffie-Hellman algorithm was one of the first asymmetric encryption schemes. Each person has their own private-public key pair. Two individuals exchange their public keys and use those to derive a shared private key that’s used for encrypted communications.
Diffie-Hellman makes it difficult for an unauthorized third party to discover the shared private key but the original algorithm is susceptible to man-in-the-middle attacks. Modern variations of the original Diffie-Hellman algorithm with improved security are still in use today.
While Diffie-Hellman played a major role in the early days of asymmetric encryption, the algorithm has mostly been replaced by more advanced public key cryptography techniques, such as elliptic curve cryptography.
RSA
Published in 1977, the RSA algorithm became one of the first widely-adopted asymmetric encryption algorithms used for secure data transmission. Unlike Diffie-Hellman, RSA provides a means of directly generating unique public/private key pairs. Accordingly, users no longer had to drive a shared private key. Digital signatures were also introduced as a way to authenticate the identity of the sender. In 1988, Lotus Notes 1.0 implemented RSA, becoming the first widely-marketed software package to offer digital signatures.
RSA is no longer practical today because advances in computing have made the algorithm vulnerable to brute-force attacks, meaning attackers can correctly guess private keys in a relatively short period of time. To avoid brute-force attacks, RSA began to implement 2048-bit private keys, rather than the original 1024-bit length. However, this additional computational overhead also makes RSA less efficient than state-of-the-art cryptographic techniques, which can provide the same level of security with a much shorter private key.
DSA
In 1991, the United States National Security Agency (NSA) proposed the Digital Signature Algorithm (DSA) as an alternative to RSA. Although this move was met with criticism from companies that had invested time and resources into the integration of RSA, DSA became a Federal Information Processing Standard (FIPS 186) in 1994.
In terms of computational performance, DSA is faster at creating digital signatures but slower at verifying them compared to RSA, making DSA a better choice on the client side. The design of DSA is quite similar to RSA. They can even be used together under some server systems (e.g. Apache) to enhance security. However, having a similar design to RSA also means DSA is subject to some of the same security issues, like brute-force attacks from powerful computers.
ECDSA
The Elliptic Curve Digital Signature Algorithm (ECDSA) is a variation of the Digital Signature Algorithm (DSA) which implements elliptic curve cryptography. The properties of elliptic curves had been studied in mathematics for 150 years. The use of elipictive curves within cryptography was first proposed in 1985 and first implemented in 2005 with the NSA's Suite B set of cryptographic algorithms. In 2009, ECDSA was implemented on the Bitcoin network, the world’s first public blockchain.
The main difference between previous algorithms such as RSA and DSA is that ECDSA defines public/private key pairs by operations on points of elliptic curves rather than using the product of very large prime numbers. Cryptographers have shown that ECDSA provides as much security with a 256-bit key as other algorithms (e.g. RSA) could only achieve with a 3072-bit key. In addition to enhanced security over previously-developed encryption algorithms, ECDSA requires less computational overhead, making it more efficient and better-suited for use on mobile devices.
📧Komodo Newsletter
If you'd like to learn more about blockchain technology and keep up with Komodo's progress, subscribe to our newsletter. Begin your blockchain journey with Komodo today.
