Public-Key Cryptography

Public-key cryptography, also called asymmetric cryptography, is a way of protecting information with two related keys instead of one shared secret. Each user has a public key, which can be published freely, and a private key, which must stay secret. Data encrypted with the public key can only be read with the matching private key, and a message signed with the private key can be checked by anyone holding the public key.

The approach underpins secure websites, encrypted messaging, software updates, card payments and every major blockchain. It is usually combined with faster symmetric encryption, which handles bulk data once the two sides have agreed a shared key. Trust in who owns which public key is managed by systems such as public-key infrastructure, and its long-term safety is the subject of current work on quantum-resistant algorithms.

Picture a letterbox with a slot in the front and a locked door at the back. Anyone walking past can drop a letter through the slot, but only the owner, who holds the key to the back door, can take the letters out. The slot is the public key and the back-door key is the private key.

Signatures work the other way round. Imagine the owner has a unique wax seal that only they possess, while everyone in town has a picture of what that seal looks like. When a sealed letter arrives, anyone can compare it with the picture and be confident it really came from the owner and was not opened along the way.

The two keys are generated together from a large random number, using mathematical problems that are easy to compute in one direction and extremely hard to reverse. In RSA the hard problem is factoring the product of two very large prime numbers. In elliptic-curve cryptography it is working backwards from a point on a curve to the number that produced it. Working out the private key from the public key would take conventional computers far longer than any practical time span, which is what makes the system secure.

Two main operations follow from a key pair:

• Encryption. A sender uses the recipient's public key to scramble a message so that only the recipient's private key can unscramble it.
• Signing. The owner uses the private key to produce a digital signature over a message, usually over its hash, and anyone can verify it with the public key.
• Key agreement. Methods such as Diffie-Hellman let two parties who have never met derive a shared secret over an open channel, which they then use for faster symmetric encryption.

Whitfield Diffie and Martin Hellman published the idea of public-key key exchange in 1976. In 1977 Ron Rivest, Adi Shamir and Leonard Adleman described the RSA algorithm, which supported both encryption and signatures. It later emerged that researchers at the UK's GCHQ had found similar ideas earlier but kept them secret. Elliptic-curve cryptography was proposed independently by Neal Koblitz and Victor Miller in the mid-1980s and became popular because it gives similar security with much shorter keys.

Public-key methods are built into the Transport Layer Security protocol that protects online banking and card checkout pages, into chip cards and into the messaging between banks. In cryptocurrency they do the job a bank's signature check would otherwise do:

• Ownership. Coins are controlled by whoever holds the private key, and a wallet address is derived from the public key.
• Authorisation. Every bitcoin or ether transaction carries a signature that nodes check before accepting it.
• Shared control. A multi-signature setup requires signatures from several keys, spreading the risk of a single lost or stolen key.

Bitcoin and Ethereum both use the secp256k1 elliptic curve, and Bitcoin added Schnorr signatures with its 2021 Taproot upgrade.

The mathematics is rarely the weak point in practice. Most losses come from stolen or badly stored private keys, phishing, flawed software or poor random number generation. A further problem is identity: a public key proves that a message came from the holder of a private key, not who that holder is, which is why certificate systems exist.

The longer-term concern is quantum computing. A large, error-corrected quantum computer running Shor's algorithm could in principle derive private keys from RSA and elliptic-curve public keys. No such machine existed as of November 2026, but the risk led the US National Institute of Standards and Technology to publish its first post-quantum cryptography standards in August 2024, and the hypothetical moment of failure is often called Q-Day.

• NIST Post-Quantum Cryptography project