Encryption & Keys

What Is Asymmetric Encryption (Public-Key Cryptography)?

Asymmetric encryption — public-key cryptography — uses a mathematically linked key pair: what one key encrypts, only the other can decrypt. The public key is shared freely; the private key never leaves its owner. This single idea enables encryption without a shared secret, digital signatures, and the entire certificate system: a certificate is simply a CA’s signed statement that a public key belongs to an identity.

How the key pair is used

For confidentiality, anyone encrypts with the recipient’s public key; only the private key decrypts. For authenticity, the owner signs with the private key; anyone verifies with the public key. TLS uses both in the handshake — the server proves it holds the private key matching its certificate, and the parties agree on a symmetric session key that carries the actual traffic, because symmetric encryption is orders of magnitude faster.

The algorithms in practice

RSA (with 2048-bit minimum keys) remains the most common in certificates; elliptic-curve algorithms (ECDSA on P-256/P-384, and the modern Ed25519) provide the same security with far smaller keys and faster operations. Post-quantum algorithms — ML-KEM for key exchange, ML-DSA for signatures — are the standardized successors, because a large quantum computer would break both RSA and elliptic curves.

Why key protection is everything

The whole model rests on the private key staying private: anyone holding it is the identity, silently and indefinitely. That is why keys belong in HSMs or TPMs where possible, why "is the key non-exportable?" is an audit question, and why verifying that a private key matches its certificate — without exposing the key — is a routine operational task.

Try it yourself — free tools

Key Matcher — verify a private key matches a certificate or CSR — in memory, never stored
CSR Generator — generate an RSA or ECC key pair and CSR
Certificate Checker — see the algorithm and key size behind any certificate

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.