Asymmetric Encryption

This is part 2 of the Symmetric and Asymmetric Encryption blog post. You can see part 1 here.

Asymmetric Encryption

Asymmetric encryption uses two keys in a matched pair to encrypt and decrypt data—a public key and a private key. There are several important points to remember with these keys:

• If the public key encrypts information, only the matching private key can decrypt the same information.
• If the private key encrypts information, only the matching public key can decrypt the same information.
• Private keys are always kept private and never shared.
• Public keys are freely shared by embedding them in a certificate.

Some examples of asymmetric encryption are:

• RSA
• Diffie-Hellman

CompTIA Security+ Study Guide

The 601 Version of the Study Guide

The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study Guide is an update to the top-selling SY0-201, SY0-301, SY0-401, and SY0-501 study guides, which have helped thousands of readers pass the exam the first time they took it.  It includes the same elements readers raved about in the previous four versions.

Each of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.

You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.

---

---

Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:

• A 75 question pre-test
• A 75 question post-test
• Practice test questions at the end of every chapter.

 

Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.

If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.

Kindle edition also available.

Asymmetric Encryption to Privately Share a Key

Although asymmetric encryption is very strong, it is also very resource intensive. It takes a significant amount of processing power to encrypt and decrypt data, especially when compared with symmetric encryption. Most cryptographic protocols that use asymmetric encryption only use it to privately share a symmetric key. They then use symmetric encryption to encrypt and decrypt data because symmetric encryption is so much more efficient.

Some of the more advanced topics related to asymmetric encryption become harder to understand if you don’t understand the relationship of matched public and private key pairs. However, because you can’t actually see these keys, the concepts are hard to grasp for some people. The Rayburn box demonstrates how you can use physical keys for the same purposes as these public and private keys.

The Rayburn Box

I often talk about the Rayburn box in the classroom to help people understand the usage of public and private keys. A Rayburn box is a lockbox that allows people to securely transfer items over long distances. It has two keys. One key can lock the box, but can’t unlock it. The other key can unlock the box, but can’t lock it.

Both keys are matched to one box and won’t work with other boxes:

• Only one copy of one key exists—think of it as the private key.
• Multiple copies of the other key exist, and copies are freely made and distributed—think of these as public keys.

The box comes in two different versions. In one version, it’s used to send secrets in a confidential manner to prevent unauthorized disclosure. In the other version, it’s used to send messages with authentication, so you know the sender actually sent the message and that the message wasn’t modified in transit.

The Rayburn Box Used to Send Secrets

Imagine that I wanted you to send some proprietary information and a working model of a new invention to me. Obviously, we wouldn’t want anyone else to be able to access the information or the working model. I could send you the empty open box with a copy of the key used to lock it.

You place everything in the box and then lock it with the public key I’ve sent with the box. This key can’t unlock the box, so even if other people had copies of the public key that I sent to you, they couldn’t use it to unlock the box. When I receive the box from you, I can unlock it with the only key that will unlock it—my private key.

This is similar to how public and private keys are used to send encrypted data over the Internet to ensure confidentiality. The public key encrypts information. Information encrypted with a public key can only be decrypted with the matching private key. Many copies of the public key are available, but only one private key exists, and the private key always stays private. The “Understanding the HTTPS Process for Security+” post shows this process in more depth.

The Rayburn Box Used for Authentication

With a little rekeying of the box, I can use it to send messages while giving assurances to recipients that I sent the message. In this context, the message isn’t secret and doesn’t need to be protected. Instead, it’s important that you know I sent the message.

When used this way, the private key will lock the Rayburn box, but it cannot unlock the box. Instead, only a matching public key can unlock it. Multiple copies of the public key exist and anyone with a public key can unlock the box. However, after unlocking the box with a matching public key, it isn’t possible to lock it with the public key.

Imagine that you and I are allies in a battle. I want to give you a message of “SY0-401,” which is a code telling you to launch a specific attack at a specific time. We don’t care if someone reads this message because it’s a code. However, we need you to have assurances that I sent the message.

I write the message, place it in the box, and lock it with my private key. When you receive it, you can unlock it with the matching public key. Because the public key opens it, you know this is my box and it was locked with my private key—you know I sent the message.

If someone intercepted the box and opened it with the public key, he or she wouldn’t be able to lock it again using the public key, so you’d receive an open box. An open box with a message inside it doesn’t prove I sent it. The only way you know that I sent it is if you receive a locked box that you can unlock with the matching public key.

This is similar to how digital signatures use public and private keys. The “Understanding a Digital Signature” post explains digital signatures in more depth. In short, I can send you a message digitally signed with my private key. If you can decrypt the digital signature with my matching public key, you know it was encrypted, or signed, with my private key. Because only one copy of the private key exists, and I’m the only person who can access it, you know I sent the message.

The Rayburn Box Demystified

Before you try to find a Rayburn box, let me clear something up. The Rayburn box is just a figment of my imagination. Rayburn is my middle name.

I haven’t discovered a real-world example of how public/private keys work, so I’ve created the Rayburn box as a metaphor to help people visualize how public/private keys work. Feel free to build one if you want.

Check out these free practice test questions for symmetric and asymmetric encryption.