Public-key cryptography protects internet communication with a mathematically related public–private key pair. Public keys can be shared; private keys remain secret. TLS depends on this approach, making it central to secure web, API, and service-to-service communication. section 6.0 section 6.2
The service key-distribution problem
An online retailer’s warehouse service sends approved refunds to payment, accounting, inventory, and marketing services. A shared AES secret must be copied into every application, making distribution difficult and turning one stolen configuration file into a broad compromise. Public-key cryptography lets each service keep its private key while sharing its public key. section 6.1
A sender encrypts data with the recipient’s public key; only the matching private key can decrypt it. The private key can also sign data, while the corresponding public key verifies the signature. Keep private keys in secure storage, such as a key vault, and generate a replacement key pair after compromise. section 6.2 section 6.6
Apply the mechanism with these practical safeguards:
- Share public keys freely, but never share private keys. section 6.2
- Use digital certificates to confirm that a public key belongs to the claimed service and to resist impersonation. section 6.5
- Use RSA-OAEP rather than the older RSAES-PKCS1-v1_5 padding scheme. section 6.6
- Use hybrid encryption for large data: AES encrypts the content, and RSA encrypts or wraps the AES key. section 6.5
- Use separate RSA key pairs for encryption/decryption and signing/verification. section 6.6
Public-key encryption solves symmetric key distribution but is slower than AES for large data. RSA security depends on the difficulty of factoring large numbers, while ECC offers smaller keys and better performance; both face possible future quantum attacks. section 6.5 section 7.3
Figure 6.3 A key pair, consisting of a private and a public key. The keys are numbers that are related by means of a mathematical equation. The private key works only with the public key in the same key pair, and the public key works only with the private key from the same key pair. The private key must be kept secret, but the public key can be shared with anyone, including friends, enemies, and hackers. Security in a public key cryptosystem depends on keeping private keys private.
A key-pair diagram clarifies why the public key may be shared while the private key must remain secret. section 6.2
Figure 6.4 Each service has a unique public–private key pair; it freely shares its public key over the network with any other service that might ask for it. When two services want to communicate, they exchange public keys and use those keys to secure the communication link. If a hacker steals a private key, only the communication link using that private key is compromised. A hacker that has access only to the public keys can’t compromise the system’s security.
A service-communication diagram shows how unique key pairs limit the impact of a compromised private key. section 6.2
