A private key is the confidential half of a mathematically linked cryptographic key pair. Keep it secret: it decrypts data encrypted with the matching public key and creates digital signatures that the public key can verify. section 6.2 section 6.6
Security depends on controlling the private key. Store it securely rather than hardcoding it in source code, configuration, or containers; a key vault can protect service keys from theft. section 6.2 section 16.2.3
Use the private key for controlled, owner-only operations:
- Decrypt ciphertext produced with the corresponding public key. section 6.4
- Sign data or selected request fields so recipients can verify authenticity and integrity with the public key. section 16.2.3 section 6.6
- Remain on a hardware security key during passwordless authentication; the device signs challenges without transmitting the key. section 15.2
- Support certificate ownership, while certificates help others validate that the associated public key belongs to the claimed service. section 8.2
Compromised service key
A warehouse service encrypts refund data with a payment service’s public key. The payment service decrypts it with its private key. If that private key is stolen, generate a new key pair and replace the compromised key; certificate revocation may also be required. section 6.4 section 6.5
Figure 6.3 A key pair, consisting of a private and a public key. The keys are numbers that are related by means of a mathematical equation. The private key works only with the public key in the same key pair, and the public key works only with the private key from the same key pair. The private key must be kept secret, but the public key can be shared with anyone, including friends, enemies, and hackers. Security in a public key cryptosystem depends on keeping private keys private.
Inspect the key-pair relationship: the private key remains secret, while the matching public key can be shared without independently decrypting data or creating signatures. section 6.2
