What is public-key cryptography?

CrabChain.org Team | Updated 13 October 2026

Public-key cryptography is one of the technical pillars supporting a large part of contemporary digital security. Whenever a person accesses a website using HTTPS, electronically signs a document, exchanges protected information, or uses certain blockchain-based systems, cryptographic mechanisms are involved that make it possible to verify identities and protect communications without requiring the parties to have previously shared a secret key. Its main characteristic is that it works with a pair of mathematically related keys, one public and one private, which perform different functions within the same system.

The shared-key problem

The need that gave rise to this approach is closely linked to one of the classic problems of cryptography. In symmetric-key systems, the sender and recipient use the same secret key to encrypt and decrypt information. The method can be highly efficient and remains fundamental to computer security, but it creates a significant difficulty when two parties do not have a secure channel through which to exchange that initial key. Public-key cryptography transformed this model by allowing one party to publish a key without revealing the secret needed to decrypt certain information or produce a signature.

The system relies on mathematical properties that make it possible to generate a pair of keys linked to each other. The public key can be shared openly, while the private key must remain under the exclusive control of its owner. Although both belong to the same cryptographic system, knowing the public key should not make it practically possible to reconstruct the private key. This asymmetry is precisely what provides one of the model's fundamental advantages and makes it possible to design secure communication mechanisms over open networks such as the Internet.

Encryption

When used for encryption, the general principle can be explained simply. A person can use a recipient's public key to protect a message intended for that recipient. The information can subsequently be recovered using the corresponding private key. In certain modern schemes, however, the actual process is more sophisticated and does not necessarily involve encrypting all the content directly with the asymmetric algorithm. It is common to combine public-key cryptography with symmetric algorithms, which are much more efficient for processing large volumes of data. The asymmetric technique is then used to establish or protect a session key, while symmetric cryptography handles the encryption of the communication.

This combination is essential in protocols such as TLS, the technology that underpins HTTPS connections. When a browser establishes a secure connection with a server, it does not need to rely exclusively on asymmetric cryptography throughout the entire session. Instead, public-key mechanisms are used during the initial negotiation to authenticate the server and establish the cryptographic elements that will subsequently protect the communication using symmetric algorithms. In this way, security, authentication, and computational efficiency are balanced.

Digital signatures

Public-key cryptography also plays a decisive role in digital signatures. In this case, the purpose is not necessarily to conceal the contents of a message, but to provide guarantees about its authenticity and integrity. A digital signature is generated using the signer's private key and can be verified by third parties using the corresponding public key. If verification succeeds, the system provides cryptographic evidence that the signature is associated with that key and that the signed content has not subsequently been altered. This explains its importance in electronic transactions, digital certificates, signed software, and numerous identification systems.

One of the most important aspects of understanding these technologies is that a public key alone does not prove who actually owns it. If a person receives a key and has no additional mechanism for verifying its origin, there is a risk that an attacker could present a different key while impersonating another entity. To address this problem, public-key infrastructure, commonly known as PKI, emerged. This model uses digital certificates and certificate authorities to link an identity to a specific public key through verifiable trust structures.

Digital certificates are especially visible in web browsing. When a browser establishes a connection with a domain protected by HTTPS, it can verify the certificate presented by the server and check that it was issued within a chain of trust recognized by the system. This process does not eliminate all Internet-related risks, but it provides a standardized mechanism for linking digital identities with cryptographic material. Security depends, among other factors, on private keys remaining protected and on the authorities and devices participating in the trust chain functioning correctly.

Algorithms

Over the past several decades, numerous algorithms based on different mathematical problems have been developed. RSA was for a long time one of the best-known and most widely deployed systems, particularly for signing and encryption. Later, elliptic-curve cryptography became highly important because it can achieve high security levels using smaller keys. Modern constructions include algorithms aimed at key exchange, such as X25519, and systems specialized in digital signatures, such as Ed25519. Each family addresses specific objectives and must be analyzed within the protocol in which it is used, since security does not depend solely on the algorithm in isolation.

In cryptocurrencies

In the field of cryptocurrencies and blockchain networks, public-key cryptography takes on an additional dimension. Addresses and accounts are generally linked to pairs of cryptographic keys, while transactions are authorized through digital signatures. Operationally, the private key represents the ability to generate valid signatures associated with specific funds or assets. For this reason, protecting the private key is one of the most critical elements of any system based on digital assets. Losing it can prevent access to the resources linked to it, while a leak can allow another person to generate authorizations that the system will regard as legitimate.

Limits and quantum computing

Despite its power, public-key cryptography is not a magic solution to every threat. Algorithms can be sound and a system can still be vulnerable because of poor implementation, inadequate key management, configuration errors, or attacks against the devices where secrets are stored. Security also depends on factors such as proper random-number generation, certificate renewal, protection against leaks, and the use of correctly designed protocols.

In addition, the development of quantum computing has introduced a new challenge for certain current cryptographic techniques. Quantum algorithms such as Shor's algorithm could compromise, if they were ever run on sufficiently powerful and fault-tolerant quantum machines, some of the mathematical problems used by systems such as RSA and certain elliptic-curve schemes. This possibility has driven the development of post-quantum cryptography, whose objective is to create public-key mechanisms resistant to that type of threat. The transition is complex because it affects digital infrastructures used on a global scale and requires planning years in advance.

The importance of public-key cryptography ultimately lies in making it possible to establish relationships of trust over networks that are inherently insecure. The Internet made it possible to exchange information on an unprecedented scale, but it needed mechanisms capable of authenticating participants, protecting communications, and demonstrating message integrity. Asymmetric cryptography provided a mathematical basis for solving a large part of these problems and has since become an invisible but essential infrastructure of digital society.

Understanding how it works also helps explain a fundamental issue in computer security. Digital trust does not depend simply on keeping a password secret, but on building mathematical and operational systems capable of demonstrating who can authorize an action, protecting a communication, and detecting unauthorized modifications. The public key can be shared, but the private key must remain under control. A substantial part of the security architecture that currently protects communications, digital services, electronic identities, and numerous financial and technological systems has been built on this distinction.

Sources

• Ethereum accounts — ethereum.org
• Post-quantum cryptography — NIST