Software distribution needs a check that anyone can verify and only the publisher can produce. Public-key cryptography, also called asymmetric cryptography, provides it with a mathematically related pair of keys. The private key remains secret, and the corresponding public key can be distributed freely. In a signature scheme, the private key creates signatures and the public key verifies them. For this to work, recovering the private key or forging a signature from the public key must be computationally infeasible.
The Public-Key Idea
By the 1970s, computer networks were making it possible for people to conduct business without meeting in person. Symmetric cryptography, using a shared key, still required them to arrange a secret key in advance. It also gave both parties the ability to generate authentication tags, so a recipient could check a message’s authenticity but could not use the tag to convince a third party that the other key holder had sent it.
In 1976, Whitfield Diffie and Martin Hellman proposed separating public and private cryptographic operations to address these problems. They described the requirements for public-key encryption and digital signatures and introduced a way to establish a shared secret by exchanging public information. A year later, Ronald Rivest, Adi Shamir, and Leonard Adleman at the Massachusetts Institute of Technology developed a system supporting both encryption and signatures. Their system, RSA, was named for the inventors.
Equivalent methods had already been found in secret at GCHQ, the British signals intelligence agency, between 1969 and 1974, but the work was classified and was not declassified until 1997.
One-Way and Trapdoor Functions
Public key cryptography rests on calculations that are efficient in one direction and infeasible to reverse. A one-way function is easy to evaluate and infeasible to invert. Several appear throughout cryptography:
- Multiplication and factoring.
- Multiplying two large prime numbers is fast. Recovering the primes from the product is not, and no efficient method is known when the primes are several hundred digits long.
- Modular exponentiation and the discrete logarithm.
- Raising a number to a power modulo a large prime is fast. Recovering the exponent from the result is the discrete logarithm problem, for which no efficient method is known.
- Scalar multiplication on an elliptic curve.
- Adding a point on a curve to itself a chosen number of times is fast. Recovering that number from the starting and ending points is believed infeasible.
- A cryptographic hash function.
- Computing a digest is fast, and preimage resistance is the requirement that reversing it is infeasible.
None of these is proven hard. They are believed to be hard because they have resisted concentrated effort for decades, which is the same standard of evidence that supports every cipher in use.
Some cryptographic operations need a calculation that anyone can perform, but that only someone holding secret information can efficiently reverse. That secret information is called a trapdoor. A trapdoor function is easy to compute in the forward direction and computationally infeasible to reverse without the trapdoor.
Factoring illustrates how extra information can change the difficulty of a problem. Given only \(n = p \times q\), where \(p\) and \(q\) are large, randomly chosen primes, recovering the factors is believed infeasible. If \(p\) is known, finding \(q = n/p\) takes a single division. This gives an intuition for the advantage that a trapdoor provides.
Trapdoors provide one way to build public-key schemes. Other constructions, including Diffie-Hellman key agreement and hash-based signatures, use one-way functions without requiring anyone to reverse them.
Public Key Cryptography
Public key cryptography gives each party two mathematically related keys. The pair is generated together, but recovering the private key from the public key must be computationally infeasible.
Public and private keys support several operations, each solving a different problem, so the role of a key depends on how it is being used:
| Operation | Who uses which key? | What it accomplishes |
|---|---|---|
| Public-key encryption | Anyone encrypts with the recipient’s public key. The recipient decrypts with the private key. | Confidential delivery to that recipient. |
| Digital signature | The signer signs with the private key. Others verify with the signer’s public key. | Publicly verifiable authentication of a message. |
| Key agreement | Each participant combines private information with the other’s public value. | Establishing a shared secret for subsequent symmetric protection. |
Encrypting with a recipient’s public key does not identify the sender, because anyone can use that public key. A signature authenticates the signed message but leaves it readable. Key agreement creates a shared secret, but the participants also need a way to check whom they are sharing it with.
The signature operation performs what a shared secret cannot do. It is asymmetric in a way that’s useful for software distribution: one signer, any number of verifiers, and no secret on any of the verifying machines.
Some of the same mathematical ideas support encryption, key agreement, and signatures, but each operation has its own construction. Keys used for signing should be separate from keys used for encryption.
RSA
RSA’s one-way function is modular exponentiation, and knowledge of the modulus’s factors is the trapdoor. Generating a key pair takes five steps:
-
Choose two large random prime numbers, \(p\) and \(q\).
-
Compute the modulus \(n = p \times q\).
-
Compute \(\varphi(n) = (p-1)(q-1)\).
-
Choose a public exponent \(e\) that shares no factor with \(\varphi(n)\). In practice, \(e\) is usually 65537, a value that makes encryption and signature verification efficient (since its binary representation contains only two 1 bits). Different key pairs use different moduli \(n\), even when they share the same exponent.
-
Compute the private exponent \(d\), the multiplicative inverse of \(e\) modulo \(\varphi(n)\), so that \(e \times d \equiv 1 \pmod{\varphi(n)}\).
The public key is the pair \((e, n)\) and the private key is \((d, n)\). The two primes must be destroyed or kept as secret as \(d\), since anyone holding either one can divide \(n\) to get the other, compute \(\varphi(n)\), and from it derive \(d\).
RSA represents a message as an integer \(P\) in the range \(0 \le P < n\). A message too long to fit in that range would have to be divided into smaller blocks. Encryption and decryption both use modular exponentiation. The equations below form the core of RSA and remain part of modern implementations:
\[C = P^{e} \bmod n \qquad P = C^{d} \bmod n\]
The way \(d\) was chosen guarantees that the second operation undoes the first. Knowing the factors of \(n\) allows someone to compute \(\varphi(n)\) and then \(d\).
A modulus of 3233 can be factored instantly. Real RSA deployments use much larger moduli; a 2048-bit modulus has about 617 decimal digits. The appendix works through key generation in more detail.
The large size is needed because factoring is far easier than searching. An attacker never has to try candidate private keys one at a time. Algorithms such as the number field sieve exploit the structure of the problem and factor a modulus in far less work than its length suggests, and the work grows slowly as the modulus grows.
A 2048-bit modulus is estimated to take about as much effort to factor as a 112-bit symmetric key takes to search, so a modulus eighteen times the length of a symmetric key provides no more security than that key. Finding the primes is not the difficulty. Primes remain plentiful at that size, with roughly one in every 355 odd numbers near \(2^{1024}\) being prime, and a key generator finds a pair in well under a second.
Splitting a long message into RSA blocks is not how systems normally use it. A sender generates a random symmetric key, encrypts that key with the recipient’s RSA public key, and encrypts the data with the symmetric key. The main reason is speed. Modular exponentiation on large numbers is much slower than AES, so RSA protects a short key while the symmetric cipher handles the data.
Elliptic Curve Cryptography
RSA keys are large and getting larger, and the arithmetic is slow. In 1985, Neal Koblitz and Victor Miller independently proposed basing public key cryptography on elliptic curves instead.
An elliptic curve can be described by an equation such as \(y^2 = x^3 + ax + b\). For cryptographic use, the coordinates and arithmetic can be taken modulo a large prime, producing a finite set of points. These points have an addition operation defined for them.
Elliptic-curve cryptography (ECC) uses repeated point addition to calculate a public value from a secret number. Adding a point \(G\) to itself \(d\) times is called scalar multiplication, written \(Q = dG\), and it can be computed efficiently even for enormous \(d\). Recovering \(d\) from \(G\) and \(Q\) is the elliptic curve discrete logarithm problem. With a suitably chosen curve and parameters, that recovery is believed infeasible. The private key is the number \(d\), and the public key is the point \(Q\).
The advantage of ECC is the key size. The best known attacks against elliptic curves are less effective than the best known attacks against factoring, so the same security needs a much smaller key:
| Security level | RSA modulus | Elliptic curve key |
|---|---|---|
| 112 bits | 2048 bits | 224 bits |
| 128 bits | 3072 bits | 256 bits |
| 256 bits | 15360 bits | 512 bits |
Key length also measures different things in the two systems. Nearly every integer of the chosen length is a usable elliptic curve private key, while an RSA modulus has to be a product of two primes, which is a sparse subset of the numbers of that length. What sets the lengths in the table is the cost of the best known attack on each problem.
Smaller keys reduce storage and communication costs. Elliptic curve methods also provide efficient key agreement and signing operations, making them useful on devices with limited resources.
Diffie-Hellman Key Exchange
Diffie and Hellman’s 1976 paper also introduced a way for two parties to arrive at a shared secret over a channel that an adversary can monitor, such as the public Internet.
Each picks a private value and uses it to calculate a public value. After exchanging those public values, each combines its own private value with what arrived, and the calculations are arranged so that both obtain the same result. Neither sends that result across the network.
The arithmetic is short. Alice and Bob carry it out in four steps:
-
They agree on a large prime \(p\) and a base \(g\). Both values are public and may be fixed by the protocol they are using.
-
Each picks a secret value at random: \(a\) for Alice and \(b\) for Bob. Neither value is ever transmitted.
-
Alice sends \(A = g^{a} \bmod p\) and Bob sends \(B = g^{b} \bmod p\).
-
Alice computes \(B^{a} \bmod p\) and Bob computes \(A^{b} \bmod p\). Both results are \(g^{ab} \bmod p\), which becomes the shared secret.
An eavesdropper sees \(p\), \(g\), \(A\), and \(B\). Recovering \(a\) or \(b\) from those values is the discrete logarithm problem. The appendix works through a small example.
Diffie-Hellman is not encryption. Nothing is sent that could be decrypted, and neither party chooses the resulting secret, which falls out of the exchange. It also authenticates nobody, so by itself it does not establish who is at the other end. We will cover how protocols use it, and what they have to add to make it safe, in detail later.
Combining Public-Key and Symmetric Cryptography
Public-key encryption can protect data, but symmetric ciphers are much more efficient for long messages. Two practical limits motivate the combination:
-
Speed. Public-key operations require expensive arithmetic on large numbers. Modular exponentiation with a 2048-bit RSA modulus costs much more than processing a short message with AES. Hardware support lets AES handle large data streams efficiently.
-
Expansion. With a 2048-bit RSA key, every encrypted block is 256 bytes. The plaintext block must be smaller because secure encoding uses part of that space. Encrypting a long message as RSA blocks therefore makes every block larger. Common symmetric encryption modes add only a small, bounded amount of overhead per message, such as an initialization vector (IV), an authentication tag, or padding in the final block. That overhead does not grow with the number of blocks in the message.
Applying the RSA equations directly to a message, often called textbook RSA, introduces two security weaknesses separate from those performance limits:
-
Determinism. The same plaintext always produces the same ciphertext. Because the encryption key is public, an attacker can encrypt likely messages and compare the results with an intercepted ciphertext. A match reveals which message was sent.
-
Malleability. An attacker can change a ciphertext so that it decrypts to a predictably related plaintext. Multiplying two RSA ciphertexts modulo \(n\) produces the encryption of the product of their plaintexts modulo \(n\). The attacker can make this change without knowing either plaintext.
Modern RSA encryption keeps the same calculations and adds a carefully designed randomized encoding of the message to prevent these attacks, even when encrypting a short key.
Systems use public-key algorithms to establish shared keys and to sign messages. Symmetric ciphers encrypt the bulk data efficiently. We will cover how protocols combine these operations in detail later.
Signing and Verification
A digital signature is a value produced from a message and a private signing key. Anyone with the signer’s public key, also called the verification key, can check it, and a valid result establishes both that the message is unaltered and that it came from the holder of the private key. The two names describe the only operation each key performs in a signature scheme. Any message can be signed: a contract, an email, a financial transaction, a certificate, a log entry, or a program.
Let’s consider the example of software distribution. The publisher generates a public-private key pair, protects the private key, and uses it to sign each update it publishes. Customers receive the update and its signature, then run a verification algorithm with those two inputs and the publisher’s public key. The result tells them whether the signature is valid for that exact message under that key.
A copy of the update can pass through an untrusted download mirror without giving the mirror the ability to alter it undetectably. To substitute a modified file, the mirror would also need a valid signature for the new contents, and producing one without the private key is computationally infeasible. The publisher must still provide customers with an authentic copy of its public key, but that key can be included in the installed software and used to verify later updates.
Hashing the Message
An update might contain gigabytes of data. Hashing lets a signature scheme process that data efficiently while its more expensive public-key calculation works with the compact hash. The signature remains tied to the entire message through the hash.
This dependence gives collision resistance a direct role in preventing forgery. Suppose an attacker creates two documents with the same digest: one harmless and one containing a fraudulent payment instruction. In a scheme that signs the digest, a signature obtained for the harmless document also verifies for the fraudulent one. The attacker chose both documents, so resistance to replacing a particular existing document is not enough. Finding any usable pair of colliding documents must be infeasible.
RSA signing applies the private exponent to a value prepared from the message’s digest using the signature scheme’s encoding rules. Verification applies the public exponent to the signature and checks the result against the message and those rules. Other schemes use different calculations, but all check a mathematical relationship between the message, the signature, and the public key.
Common signature schemes include:
-
RSA-PSS, RSA’s Probabilistic Signature Scheme, combines hashing with a randomized encoding that prepares the digest for signing. RSA encryption uses different preparation rules.
-
ECDSA, the elliptic curve digital signature algorithm, appears in TLS certificates, Bitcoin, and code signing.
-
Ed25519 is a more recent elliptic-curve scheme. It is deterministic, deriving its per-signature random value from the message and the key rather than drawing it from a generator, which removes an entire class of implementation failure.
Signatures Built Only From Hash Functions
Digital signatures can be built from hash functions without relying on factoring or discrete logarithms. In 1979, Leslie Lamport described a one-time signature scheme based on one-way functions. The basic idea is that revealing a secret can prove a choice that the signer made.
Consider signing a message containing just one bit:
-
Key generation. Generate two long, random secret values: one for 0 and one for 1. These values form the private key. Hash each value and publish the two digests, labeled 0 and 1, as the public key.
-
Signing. Reveal the secret corresponding to the message bit. To sign 0, reveal the secret for 0; to sign 1, reveal the secret for 1. The revealed value is the signature.
-
Verification. Hash the revealed value and compare it with the public digest labeled with the message bit. A match verifies the signature.
Each possible bit value has its own secret. After seeing a signature for 0, an attacker knows the secret for 0 but still lacks the secret needed to sign 1. Preimage resistance makes finding that missing secret from its published digest computationally infeasible.
To sign a longer message, first hash it with a collision-resistant hash function. Use a separate pair of secrets for every position in the digest, revealing one secret from each pair. A 256-bit digest therefore requires 256 pairs of secrets, and its signature contains 256 revealed values.
There are two limitations to this scheme: (1) the keys and signatures are large, and (2) each key pair should sign only one message. Signing a second message with the same key reveals both secrets wherever the two digests differ, and an attacker can then combine previously revealed secrets to attempt forgeries.
Ralph Merkle showed how to combine many one-time signing keys under a single public key, using a fresh signing key for each message. This idea underlies one of the post-quantum signature schemes we will discuss later.
What a Signature Establishes
Because a recipient can verify a signature without being able to create one, the signed message can serve as evidence to others. With a MAC, the recipient could have generated the tag. A signature removes that ambiguity and supports non-repudiation: evidence against a later denial that the holder of a signing key signed a message.
The evidence depends on how the key was protected. Anyone who steals the private key can produce valid signatures, and verification cannot reveal who was at the keyboard or what they intended. Connecting a signature to a person therefore also depends on identity checks and records of key use.
A signature also leaves the truth and safety of the message for the recipient to judge. Galileo’s anagram could preserve an incorrect astronomical claim, and a software signature can authenticate a program with a serious vulnerability. The signature establishes a connection between particular bytes and a signing key.
That leaves the question the next section answers. A verifier holding a public key and a valid signature knows only that the two match, and an attacker can generate a key pair as easily as anyone else. Accepting those bytes as a trusted software update requires knowing whose key it is.