33.4 Asymmetric Encryption
Asymmetric (public-key) encryption uses a key pair:
- the public key can be shared with everyone;
- the private key is kept secret by the owner.
What one key locks, only the other key opens. So:
| You want to | Use |
|---|---|
| Send a secret to Sneha | Encrypt with Sneha's public key – only her private key can open it |
| Prove a message came from you | Sign with your private key – anyone checks it with your public key |
Algorithms: RSA (2048-bit minimum, 3072+ preferred), ECC such as ECDSA and Ed25519 (smaller keys, same strength), and Diffie-Hellman / ECDHE for agreeing on a shared key over an open network.
Asymmetric crypto is slow, so real systems use it only to exchange or protect a symmetric key, then switch to AES. This mix is called hybrid encryption – it is exactly what TLS and PGP do.
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem
echo "Meeting at Shaniwar Wada 5pm" > msg.txt
openssl pkeyutl -encrypt -pubin -inkey public.pem -in msg.txt -out msg.enc
openssl pkeyutl -decrypt -inkey private.pem -in msg.enc
ssh-keygen -t ed25519 # your SSH keys are the same idea: id_ed25519 (private), id_ed25519.pub (public)
Ravindra Bagale's Tip
Private key cha naav ch "private" aahe – te email, WhatsApp kiwa GitHub var kadhich nahi. Students chukun .pem file repo madhe push kartat. Public key share kara, private key fakt tumchyakade, chmod 400 sobat.
Lab
Generate an RSA key pair, give your public.pem to a partner, and ask them to encrypt a short message for you. Decrypt it with your private key. Then explain in two sentences why they could not decrypt their own encrypted message without your private key.