Public Versus Private Key Encryption

The example above was an example of private key encryption. In this type of encryption, the sender and receiver both own a secret decoder/encoder algorithm. The sender encrypts using the algorithm and the receiver decrypts using the reverse.

There are several problems with this approach. For one, how do you exchange keys safely. If you are worried about the security of your communication, you can't just send the private key to the receiver over the network. If someone gets a hold of the private key, all communication can be decoded.

Unfortunately, using private key encryption, you must exchange the key in person.

Further, what happens when you exchange your key with someone who is less than dependable and some third party steals it?

Modern day encryption gets around these problems through the use of public key encryption.

Public key encryption is based on a certain type of mathematical algorithm that provides one way encryption/decryption. That is, a public key algorithm allows you to encrypt a message with a special key that has some very special properties....

1. Encrypted messages can only be unencrypted with a single private key.
2. It would be beyond the realm of probability to break the secret key through possession of the public key and encoded message.

Thus, rather than distributing your private decryption and encryption keys to trusted parties and crossing your fingers, you distribute your public key to anyone who wants it with full confidence that messages sent to you that have been encrypted with your public key will only be readable by you.

Any sender can encrypt their message with your public key and that message will only be able to be unencrypted with your private key.

There are several popular magical algorithms for public key encryption including RSA, Diffie-Hellman, and Elliptic-Curve cryptography and several packages such as PGP to implement them within your web applications.

There is another function of private keys that should be mentioned. Private keys also have the added benefit that a bit of text which has been encrypted with the private key, can be verified through the use of the public key to have been encrypted by the holder of the private key. This is called a digital signature and can provide message authenticity because only the holder of the private key could encrypt such a message. The same method can be used to verify message integrity because a hash digest may be created by the sender representing the pre transmission file state.

Encryption
Introduction to the Web Application Development Environment (Tools)
Secured Transmission (SSL , HTTPS)