Private and Public Key

Table of contents

  1. Definition
  2. Terminology
  3. Example of Private and Public Key Relationship
  4. Reference
  5. Deep Dive
  6. Example of Private and Public Key

Definition

  • Private Key
    • The private key, also known as a secret key, is a variable in cryptography that is used with an algorithm to encrypt and decrypt data. Secret keys should only be shared with the key generator or parties authorized to decrypt the data. Private keys play an important role in symmetric cryptography, asymmetric cryptography and cryptocurrencies.
  • Public Key
    • The public key is generated by the private key that is fed into Trapdoor function (e.g., elliptic curve), which means that Priave and Public Key are pair.

Terminology

  1. Public Key Infrastructure (PKI): PKI is usually designed around a centralized and trusted component called the Certificate Authority (CA), which binds and unbinds entities to their public keys by issuing and revoking digital certificates, and also functions as the repository for active digital certificates.
  2. Public Key Cryptography Standards (PKCS): The Public-Key Cryptography Standards (PKCS) comprise a group of cryptographic standards that provide guidelines and application programming interfaces (APIs) for the usage of cryptographic methods. As the name PKCS suggests, these standards put an emphasis on the usage of public key (that is, asymmetric) cryptography.

Example of Private and Public Key Relationship

For better understanding, Let’s take a look at a famous example. The two keys shall not be separated in asymmetric cryptography. In other word, they have relationship as shown in [Pic.1]

Bob wants to send Alice an encrypted email. To do this, Bob takes Alice’s public key and encrypts his message to her. Then, when Alice receives the message, she takes the private key that is known only to her in order to decrypt the message from Bob. Although attackers might try to compromise the server and read the message, they will be unable to because they lack the private key to decrypt the message. Only Alice will be able to decrypt the message as she is the only one with the private key. And, when Alice wants to reply, she simply repeats the process, encrypting her message to Bob using Bob’s public key.


[Pic.1] Private and Public Key Relationship

Reference

Please refer to the listed reference below. That help you understand what is Private and Public Key in deatil.

Deep Dive

  1. Random Number
    • Before diving into private key, we need to look at the meaning of Random Number, because a private key is generated based on randomness.
    • As definition, Random Number is either Pseudo-random or a number generated for, or part of, a set exhibiting statistical randomness in mathematics and statics.
    • Random Number has the following properites
      • Randomness: Randomness is the apparent or actual lack of definite pattern or predictability in information. It means that there is no order and does not follow a deterministic pattern. Mote Carlo method is one of the example that relies on random input.
      • Unpredictability: Whatever someone uses any kind of information or method, no one can predict the next result.
      • Impossilbe Reconstruction: Same result shouldn’t be represent.
    • Type of Random Number
      • Deterministic Random Number Generator (DRNG): It generates a deterministic random number.
        • Pros
          • No dedicated hardware is required.
          • Implementations can be done in software.
          • Identical seed values imply identical random numbers which is a necessary condition for using them as stream ciphers.
        • Cons
          • For pure DRNGs, the output is completely determined by the seed.
          • Output sequences of pure DRNGs cannot be truly independent.
          • They may behave as output sequence of an ideal RNG at most with respect to certain aspects.
          • The internal state has to be protected even if the device is not active.
      • True Random Number Generator (TRNG): It generates Random Number based on a physical process capable of producing entropy. The higher the entropy is, The higer the randomness. Nature provides ample phenomena that generate low-level, statistically random “noise” signals, including thermal and shot noise, jitter and metastability of electronic circuits. So, Hardware Random Number Generator uses this feature to generate TRNG.
      • Pseudo Random Number Generator (PRNG): It has a model that minics generating Random Number based on a ‘deterministic’ algorithm. In other word, it tries to imbue randomness property with deterministic algorithm. ‘Deterministic’ means that it needs a specific input to generate a random number. When look at the generation of tons of random number, you may notify a pattern. The seed of PRNG is extracted from TRNG, which means that the input which will be fed into PRNG also has the randomness.
      • Cryptographically Secure Pseudo Random Number Generator (CSPRNG): CSPRNG is random generators, which guarantee that the random numbers coming from them are absolutely unpredictable. CSPRNG satisfy the next bit test and withstand the state compromise extensions and are typically part of the operating system or come from secure external source. Depending on the level of security required, CSPRNG can be implemented as software components or as hardware devices or as combination of both.
  2. Private Key
    • Private key is generated by ‘n’ times ‘dot’ operation in ECC, giving randomness property to the private key. It menas that the ‘n’ is randomly generated integer value (PRNG).
    • The private key can be genreated by random number generator, but, for certificate and digital signature, ECC combined with random number generator is preferable.
    • Given at the meaning of Rondom number expained above and the property of ECC, it is hard for attackers to predict the generated private key in this way without directly accessing a storage having the private key.
    • Private Key can be used in symmetric cryptography system, but assymetric cryptography system (public key cryptography) is more secure approach in the real world.
  3. Public Key
    • By understanding the definition of private and public key and the meaning of random number, we learned that ‘public key’ stems from ‘private key’. The public key shall not be used solely as itself. Please don’t be confused that public key system is using this key only.
    • Let’s take a look at the definition of Public Key Cryptography.
      • Public Key Cryptography (PKC): A well-established way to provide an authentication service. An entity is represented with a pair of keys (a publick key, a private key). The public key is used as the ID of the entity while the private key is used to prove the ownership of the public key. The public key is disseminated in the form of a digital certificate that binds the entity’s identity to the entity’s public key. A published pair keys shall be unique.
    • In sum, PKC is using a pair of private and public key. Thus, a public key will be generated in a way that
      • PRNG generates a private key and ‘n’ parameter of ECC.
      • Define ECC Domain Parameters (normally specified in a Certificate).
      • Feed the generated private key into ECC.
      • Execute Dot Operand (n times).
      • Extract x and y coordinates of the final point of ECC. The result shall be a generated public key.
      • The real example of private and public key is shown in [Pic.2]
    • Based on PKC, you will face two famous crypto algorithm. ‘RSA Public Key Algorithm’ and Elliptic Curve Digital Signature Algorithm (ECDSA)’
    • So, as long as a issued certificate to a user is not hijacked by attackers, it is hard for them to break this cryptography system theoretically.

Example of Private and Public Key


[Pic.2] Private and Public Key Example