# Public-key cryptography

> Two linked keys: one you share with everyone to lock, one you keep to unlock.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/public-key-cryptography/
- In Spanish: [Criptografía de clave pública](https://tidbit.legios.com.ar/es/public-key-cryptography/)

**Public-key cryptography** uses a mathematically linked **key pair**. What the **public key** locks, only the **private key** opens, and the public key cannot be used to work out the private one. So you can publish your public key anywhere, and anyone can send you something only you can read. The older kind, symmetric encryption, uses one shared key for both directions, which leaves a hard problem: how do two strangers agree on a secret over a network everyone can listen to?

That is the problem it solves, and it is why the internet works. When your browser opens an HTTPS site, it uses the server's public key (delivered inside its TLS certificate) to agree on a fresh symmetric key, and the rest of the session runs on that faster key. The same idea protects your `ssh` login to a server (your public key sits on the server, your private key never leaves your laptop), the messages in end-to-end encryption apps, cryptocurrency wallets and passkeys.

The pair also works backwards, as a **digital signature**: something locked with your private key can be opened by anyone with your public key, which proves it came from you and was not changed. Software updates, Git commits and certificates are signed this way. Common algorithms are RSA and elliptic-curve ones like Ed25519; the latter are smaller and faster and are now the default.

The one rule that matters in daily life: the private key is the whole secret. Whoever has the file (or the seed phrase of a crypto wallet) is you, as far as the math is concerned.

## An analogy

A mailbox with a slot. Anyone can drop a letter in (the public key), but only the owner's key opens the door (the private key). A signature is the reverse: a wax seal only you can press, which anyone can recognize.

## Keep in mind

- A key pair: public to lock, private to unlock, and the public one does not reveal the private one.
- It lets two strangers agree on a secret over a network anyone can listen to.
- Reversed, it makes digital signatures: proof of who sent something and that it was not altered.
- The private key is the whole secret; whoever holds it is you.

## Go deeper

- [How does public key encryption work? (Cloudflare Learning Center)](https://www.cloudflare.com/learning/ssl/how-does-public-key-encryption-work/)
- [Public-key cryptography on Wikipedia](https://en.wikipedia.org/wiki/Public-key_cryptography)

## Related terms

- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Internet](https://tidbit.legios.com.ar/internet/): A worldwide network of networks that lets any connected device reach any other.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.
- [HTTPS](https://tidbit.legios.com.ar/https/): The padlock in your browser: web traffic nobody in between can read.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [TLS certificate](https://tidbit.legios.com.ar/tls-certificate/): The ID card a website shows your browser to prove it is who it claims to be.
- [End-to-end encryption](https://tidbit.legios.com.ar/end-to-end-encryption/): Only the sender and the recipient can read a message; the service in between cannot.
- [Passkeys](https://tidbit.legios.com.ar/passkeys/): A way to sign in without a password, using your phone's or computer's lock instead.