A Weird Device
Imagine you were given a lockbox and two different keys – a red and a green one. This is, however, no ordinary box. Mysteriously, once locked with one of the keys, it can only be unlocked by the other key. Thus if locked with the green key, it can only be unlocked by the red key and vice versa. In addition, the box can not be destroyed or damaged. If anything is locked inside and the corresponding unlock key is lost – there is no way of opening it again. The contents are lost for all eternity.
Enter the mind-twisting world of asymmetric cryptography (also known as public key cryptography).
There are no magical lockboxes, however. Only math at its finest. As we already learned, symmetric encryption requires the same key for both, encrypting and decrypting. Asymmetric encryption, on the other hand, requires a mathematically related pair of different keys. Each key can encrypt, but only the other key can decrypt the message. To visualise this, let us name the keys A and B.
key’A + Message → (Encrypted Message)’A
key’B + (Encrypted Message)’A → Message
key’B + Message → (Encrypted Message)’B
key’A + (Encrypted Message)’B → Message
Trusting a Stranger
Why would someone use asymmetric over symmetric encryption? Doesn’t it complicate things more due to the additional key being required? Think about the following:
What if Caesar’s Lieutenants wanted to make sure that an order really came from Caesar himself? With the Caesar Cipher, there is one key known to all recipients. Of course Caesar could use a different key for every Lieutenant, but this would be rather inconvenient. What if some Lieutenants were placed at the other end of the Roman empire, and never actually saw Caesar in person? How can they know that the orders really came from him, and not from a betrayer, who also knew the symmetric key and created forged orders?
The answer is authentication. For this, one of the keys needs to be kept private and not shared with anyone else. The other can be sent into the wild to as many recipients as required. Let us call the keys “Private Key” and “Public Key“.
If Caesar encrypted his orders with his private key, they can only be decrypted by recipients who possess his public key. In addition, the recipients can be absolutely sure that the orders really came from Caesar himself, since only encrypting them with his private key would produce a valid message when decrypting with his public key.
Chain of Trust
Asymmetric encryption allows for creating a so called chain of trust. Within this concept, there is only one central authority that needs to be trusted. This authority allows a person to be sure he knows who he communicates with, even if he has never seen the other before. For example, if your colleague gives you his public key in person, you can safely assume that it is really his. Any encrypted messages, decryptable by this key are certainly from him. However, if you receive a public key on a postcard, which claims to be from your colleague, there is no way of knowing it is really his.
What if your boss single handedly gave his public key to all his employees. Then you receive an encrypted mail from your boss, which states that key XYZ is the public key of your colleague. Since you know that the message really came from your boss (it is only decryptable with his public key, which he gave you in person), and you trust your boss, there should be no doubts about the ownership of the received key.
This is how you know the site you are entering your credit card information into is amazon and not some imposter:
Your browser has several built in public keys of trustable authorities. Whenever you open amazon.com, the site sends you an encrypted message, which can be decrypted by one of the built in authority public keys (thus the message was issued by a trustable authority, and you can trust its content). The content of the message is “amazon’s public key: XYZ“. When sending your credit card information, it is encrypted with amazon’s public key, which you just received. It can only be decrypted by someone who possesses amazon’s private key (presumably only amazon itself).
authority’s private key + message: “amazon’s public key: XYZ” = (Encrypted Message)’authority
authority’s public key + (Encrypted Message)’authority = message: “amazon’s public key: XYZ”
amazon’s public key + message: “your credit card info” = (Encrypted Message)’amazon
amazon’s private key + (Encrypted Message)’amazon = message: “your credit card info”
Messages issued by such authorities, naming the public key of a website are called certificates. If you own a webstore and want to make sure your clients know they are shopping on your site, you go to an authority and pay for a certificate. It is the authority’s task to make a background check and confirm you are entitled to the certificate you require. There are sometimes cases of rogue authorities, issuing valid, but fake certificates, allowing imposters to steal user data. However, this is a rather rare scenario and seeing an icon in your address-bar usually means your encryption is secured using SSL/TLS, which employs asymmetric encryption (the details of how SSL/TLS exactly works will be covered in a separate topic).
Read a much more detailed explanation of asymmetric encryption here.