Understanding Asymmetric Encryption in 2 Minutes

Before starting to read this article, it is advisable to understand the concept of symmetric encryption, explained in this article.

How it works

Asymmetric encryption relies on two distinct keys:

• A public key, which can be freely distributed.
• A private key, which must remain secret.

The public key is used to encrypt data. But once encrypted, only the private key can decrypt it.

So you can publish your public key without risk, as long as the private key remains well protected.

In most cases, the public key is sent to the client (browser, application, etc.), while the private key is kept on the server.

Indeed, client-side software can be analyzed or decompiled, whereas server-side code remains confidential.

A simple analogy

When you were a child, there's a good chance you had — or dreamed of having — an invisible ink pen to send secret messages to your friends. Well, we can reuse this concept to explain asymmetric encryption.

Here, the public key is the invisible ink pen: it lets us write messages that no one can read. And the private key is the UV lamp: only the person who owns it can read the messages written with the pen!

Of course, this analogy has its limits: several people could have a UV lamp to reveal the messages.

But imagine that you are the only person who knows the right wavelength to make the invisible ink appear.

In this case, anyone can write with this pen (public key), but only you can read the message (private key).

Asymmetric vs Symmetric

Symmetric encryption is very practical because it allows encrypted communication in both directions: two machines or pieces of software can exchange confidential messages, as long as the key remains secret.

But this method has a weak point: the exchange of the encryption key.

Indeed, if an attacker manages to intercept this key during the initial exchange, they will be able to read all future messages, no matter how robust the algorithm or how long the key is.

Why keep using symmetric encryption?

In a world where asymmetric encryption exists, why do we still use symmetric encryption?

Because asymmetric encryption is very powerful, but also slower and more resource-intensive. It is often used to establish a secure channel at the start of a communication.

Very often, a temporary symmetric key is generated and shared securely thanks to asymmetric encryption. This key is then used to efficiently encrypt all subsequent exchanges in both directions.

This is the case with HTTPS communications

When you visit a secure website, the first connection uses asymmetric encryption to establish trust. Then, exchanges are encrypted symmetrically for greater speed.

Asymmetric signatures

If we zoom out from symmetric encryption to discuss asymmetric cryptography in general, we discover a related use case.

The asymmetric signature of data.

In this case, we don't encrypt a message to make it confidential, but rather we encrypt a fingerprint (hash) of the message with a private key. This signature can then be verified by anyone using the public key.

This makes it possible to guarantee that the information really does come from the sender and that it has not been altered.

This is, for example, the mechanism used to authenticate JWT tokens.