What is Asymmetric Encryption? How it Works and Why It's Secure

The problem with symmetric encryption is that before exchanging a secured message, two people have to find a way to exchange the key. This key exchange is a major security risk.

Asymmetric encryption solves this issue of the initial transfer of the key. Instead of having 1 key that can encrypt and decrypt. They created a system where there are two keys: a first one only decrypts and a second one only encrypts. In fact, you don’t need to worry about sharing a key that can only encrypt a message and not decrypt it.

Asymmetric encryption works like a mailbox.

Anybody can put an envelope in a mailbox, but only the mailman can take its content. With asymmetric encryption, the whole in the mail box is called the public key, anybody can know that key, it can only encrypt (lock). And the key to open the mailbox is called the private key, it is know only to the receiver of the information and can only decrypt (unlock).

The term key for the public key is misleading. The public key is a mathematical equation whose role is to transform a message into something unreadable. Lets call this equation f(x)

• f(x) is uniq to the receiver of the message. You have one, I have a different one, grandma has one also. It is public so anyone can know the f(x) of someone else and send them a message.
• x is the readable message
• f(x) = y
• y is the encrypted message transferred over the internet

We learned in school that it is possible to reverse a function. If ax+b = y, then x = (y-b)/a. Finding x when you know y and f(x) is dead simple. This is where the beauty comes in, with asymmetric encryption, when you know y and f(x), you cannot find x. The f(x) function is so complex that the best computers cannot reverse it.

Remember: y is the encrypted message, f(x) is the complex function, and x is the decrypted message. The receiver has more information, he/she knows the following:

• y = f(x)
• f(x) = 𝚫 g(x)
• g(x) is a function much simpler to compute,
• 𝚫 is a constant, the private key. If the receiver knows 𝚫, he can easily get x from y (the encrypted message).

What if… the private key I am using to send a message doesn’t really belong to the person I want to send information to?

Fake public keys : you think you are sending your info to someone but you are actually sending it to someone else. In fact, if public keys are public and everybody can use and handle them, someone could alter them.

A user needs to be sure that the public key he is using belongs to the person he/she wants to send data to.

There is a 3rd party system, this third party will certify that the key you are using is valid. The third party is called a certificate authority, it issues a certificate that certifies the ownership of key pairs. The certificate contains the public key and the identity of the owner.

Example : asymmetric in the technology behind https. The website wants to assure you that if you type your password in the field, the password won’t go anywhere else than in their server. When you go on a website and the https is green, it means the certificate authority has validated the certificate of the website, the public key at your disposal is correct, you can safely enter any information you want on the website.

All in all, asymmetric encryption provides security by allowing to share a key that can only encrypt. The certificate authority acts as a third party providing trust to the user.