5.4 Asymmetric Cryptography

TLDR

Asymmetric cryptography uses a key pair, one public and one private, that work as mathematical inverses so people can communicate securely without sharing a secret key first. To send someone encrypted data, you use their public key, and only their matching private key can decrypt it. Longer keys mean larger keyspaces and stronger security, but key lengths can only be compared fairly within the same algorithm.

Why This Matters for the AP Cybersecurity Exam

This topic builds the core decision-making skill of picking the right key for the right job. You should be able to determine which key encrypts and which key decrypts in a given scenario, explain why a longer key is harder to crack, and apply asymmetric tools like OpenSSL to encrypt or decrypt a file. Expect questions that put you in a real situation (someone sending a confidential file) and ask you to reason through which key to use and why the private key must stay protected. The math of keyspace and brute force shows up when you explain why key length affects security.

Key Takeaways

• Each receiver generates a key pair of equal-length binary strings; one becomes the public key and one becomes the private key, and they reverse each other.
• To send secure data, encrypt with the recipient's public key so only their private key can decrypt it.
• The private key must be stored securely; if it is exposed, stolen, corrupted, or shared, delete the pair and generate a new one.
• An n-bit key has a keyspace of 2^n, and random guessing finds the key in about 2^(n-1) guesses on average.
• Key-length comparisons only make sense within the same algorithm (AES vs AES, RSA vs RSA), not across different algorithms.
• RSA and ECC are common asymmetric algorithms used for encryption, digital signatures, and digital certificates.

How Asymmetric Encryption Works

Symmetric encryption has one big weakness: both people need the same secret key, and they have to share it without anyone else getting it. Asymmetric cryptography solves that. Instead of one shared key, each person gets a pair of keys that work as mathematical opposites. This is the system that lets you safely send your card info to a website you have never visited, and it is the backbone of secure communication on the internet.

Asymmetric encryption lets two people communicate securely without agreeing on a shared secret ahead of time. With symmetric encryption, you and your friend both need the same key, which means you have to find a safe way to exchange it first. Asymmetric encryption skips that step.

Anyone who wants to receive encrypted messages first generates a key pair. A key pair is two binary strings of equal length, created together through a mathematical process. One key gets labeled the public key and the other becomes the private key.

These keys are mathematical inverses of each other. Whatever one key encrypts, only the other key in the pair can decrypt. Either key can do the encrypting, but its partner is the only thing that can undo it. A key cannot decrypt something it encrypted itself.

Public vs. Private Keys

The names tell you how to handle each key:

• The public key is meant to be shared. You can post it on your website, email it around, or publish it in a directory. Anyone who wants to send you a secure message needs it.
• The private key must stay secret. Store it somewhere safe, like an encrypted file, a hardware security module, or a password manager. The entire security of the system depends on this key staying private.

If your private key ever gets exposed, stolen, corrupted, or shared (even by accident), the whole key pair is burned. You have to delete it and generate a new one. There is no recovering from a leaked private key, because anyone who has it can decrypt every message that was sent to you.

Choosing the Right Key

This is where students often get tripped up. Which key do you use, and when? The rule is simple once you see the pattern:

To send an encrypted message to someone, use their public key. Only they have the matching private key, so only they can decrypt it.

Here is an example. Say you want to send a confidential file to your friend Maya.

1. Maya generates a key pair. She keeps her private key locked down on her laptop and publishes her public key online.
2. You download Maya's public key.
3. You encrypt the file using Maya's public key.
4. You send the encrypted file to Maya, even over an unsecured channel like regular email.
5. Maya decrypts it using her private key.

Even if an attacker intercepts the encrypted file, they cannot read it. They do not have Maya's private key, and her public key (the only thing they have) cannot undo its own encryption.

Flip the scenario: if Maya wants to send something back to you, she uses your public key, and you decrypt with your private key. Each person needs their own key pair.

Quick Reference

Why Key Length Matters

The security of encryption depends heavily on how long the key is. Longer keys are harder to crack, but they also take longer to use. There is a tradeoff.

Keyspace and Brute Force

A keyspace is the total number of possible keys for a given key length. For binary keys, an n-bit key has a keyspace of $2^n$.

So a 4-bit key has $2^4 = 16$ possible values. A 128-bit key has $2^{128}$ possible values, which is a number with 39 digits. A 2048-bit RSA key has a keyspace so enormous it is hard to picture.

If an attacker tries to brute-force a key by guessing randomly, on average they will find it after checking about half the keyspace. That is $2^n / 2$ or $2^{n-1}$ guesses. Even with a fast computer, this becomes impossible for large keys.

The Tradeoff

Longer keys are not free. They take more processing power to generate, encrypt with, and decrypt with. On a phone or low-power device, using a giant key can slow things down. That is why you pick a key length that is secure enough for your needs without being overkill.

Keys Get Longer Over Time

Computers keep getting faster, and software can guess keys faster as processing power and efficiency improve. What was considered uncrackable years ago can be broken much more quickly today. Because of this, recommended key lengths keep going up for both symmetric and asymmetric algorithms.

Comparing Key Lengths Fairly

Here is an important catch: you can only directly compare key lengths within the same algorithm. For example:

• An AES 256-bit key is more secure than an AES 128-bit key. (Valid comparison.)
• An RSA 4096-bit key is more secure than an RSA 2048-bit key. (Valid comparison.)
• An RSA key and an AES key cannot be directly compared to decide which is more secure. (Not a valid comparison.)

Different algorithms use their key bits differently, so comparing bit lengths across algorithms gives you the wrong answer. Stick to comparing keys within the same algorithm.

Common Asymmetric Algorithms

Two algorithms come up most often:

• RSA (Rivest, Shamir, Adleman): A classic asymmetric algorithm. Common key sizes are 2048 and 4096 bits.
• Elliptic Curve Cryptography (ECC): An approach that uses the math of elliptic curves.

Asymmetric algorithms are used for more than sending secret messages. They also power digital signatures (proving a message really came from a specific sender) and digital certificates (part of what makes secure web connections work in your browser).

Using Asymmetric Encryption in Practice

You can encrypt and decrypt with asymmetric algorithms using command-line tools, specialized software like RSA Encryption Tool, or web-based tools. A common command-line tool is OpenSSL.

Generating an RSA Key Pair

To create a 2048-bit RSA key pair and save it to a file called rsa.pem:

</>Code
openssl genrsa -out rsa.pem 2048

The rsa.pem file contains the private key material. Treat this file like a password. If someone gets it, they have your private key.

Extracting the Public Key

You do not want to hand out the file that contains your private key. You need to pull just the public key into its own file. To extract the public key from rsa.pem and save it to public.pem:

</>Code
openssl rsa -pubout -in rsa.pem -outform PEM -out public.pem

Now public.pem is safe to share with anyone. They will use it to encrypt messages for you.

Encrypting a File

Say someone wants to send you a file called test. They use your public.pem to encrypt it:

</>Code
openssl pkeyutl -encrypt -pubin -inkey public.pem -in test -out test.enc

The -pubin flag tells OpenSSL that the input key is a public key. The encrypted output gets saved as test.enc. They send test.enc to you over any channel they want, even an insecure one.

Decrypting a File

When you receive test.enc, you decrypt it with your private key file:

</>Code
openssl pkeyutl -decrypt -inkey rsa.pem -in test.enc -out test

This reverses the encryption and gives you back the original test file. Notice you used rsa.pem (which contains your private key) for decryption, not public.pem.

Putting It All Together

A full workflow for receiving a secure file looks like this:

1. Generate your key pair with openssl genrsa.
2. Extract your public key with openssl rsa -pubout.
3. Share public.pem with the sender. Keep rsa.pem locked away.
4. The sender encrypts the file with your public key using openssl pkeyutl -encrypt.
5. They send you the encrypted file.
6. You decrypt it with your private key using openssl pkeyutl -decrypt.

The point of this system is that steps 3 and 5 can happen in the open. The public key being public is the whole idea. As long as your private key stays private, the messages stay safe.

How to Use This on the AP Cybersecurity Exam

Choosing the Right Key

When a question describes a sender and a receiver, slow down and identify who is doing what. To encrypt data for someone, use that person's public key. To decrypt data you received, use your own private key. The most common mistake is reaching for the wrong key in a scenario, so trace it step by step.

Explaining Key Length

If you are asked why a longer key is more secure, connect it to keyspace. An n-bit key has 2^n possible values, and brute-force guessing takes about 2^(n-1) tries on average. Mention the tradeoff: longer keys are stronger but slower, and recommended lengths rise over time as computers get faster.

Comparing Algorithms

Watch for traps that compare an RSA key length to an AES key length. Those are not directly comparable. Only compare key lengths within the same algorithm.

Applying the Tools

Be ready to read or order OpenSSL commands. Know that genrsa makes the key pair, rsa -pubout extracts the public key, pkeyutl -encrypt -pubin encrypts with a public key, and pkeyutl -decrypt decrypts with the private key.

Common Misconceptions

• "The same key encrypts and decrypts." That is symmetric encryption. In asymmetric encryption, one key encrypts and only its partner can decrypt.
• "You encrypt with your own public key to send a message." You encrypt with the recipient's public key, not your own, so only the recipient can decrypt it.
• "A longer RSA key is automatically more secure than a shorter AES key." Key lengths are only comparable within the same algorithm. RSA and AES bit lengths cannot be directly compared.
• "If my private key leaks, I can just keep using it carefully." A leaked, stolen, or corrupted private key means the entire key pair must be deleted and regenerated.
• "Sharing my public key is risky." The public key is meant to be published. The public key cannot decrypt what it encrypted, so sharing it does not expose your messages.
• "Longer keys are always the best choice." Longer keys cost more processing time, so the right length balances security needs with performance.

Related AP Cybersecurity Guides

• 5.1 Application and Data Vulnerabilities and Attacks
• 5.3 Protecting Stored Data with Cryptography
• 5.2 Protecting Applications and Data: Managerial Controls and Access Controls
• 5.5 Protecting Applications
• 5.6 Detecting Attacks on Data and Applications