How deeply does Secure APIs cover public-private key pair?

Explains signing roles, OpenSSL generation, Python loading, and validation safeguards, but does not detail cryptographic mathematics.

Public-private key pair

As explained in Secure APIs

A public-private key pair consists of mathematically related cryptographic keys, with the private key used for signing and the public key used for verification.

A public-private key pair contains two mathematically related cryptographic keys. Keep the private key for signing JWTs; distribute the public key for validating their signatures. section 8.2 section 8.7

This arrangement lets an API verify tokens without receiving the signing secret. Generate the pair before using an asymmetric algorithm such as PS256, and validate the token’s claims while constraining the permitted algorithm. section 8.2 section 8.7

Generate an RSA pair for JWTs

OpenSSL can create a 3072-bit RSA pair with `openssl genpkey -algorithm RSA -out private_key.pem -outpubkey public_key.pem -pkeyopt rsa_keygen_bits:3072`. Load `private_key.pem` for signing with PyJWT and PS256; use the corresponding public key to verify signatures. section 8.2

How Secure APIs covers it

liveBook manning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersA public-private key pair is a mathematically related pair of asymmetric cryptographic keys in which the private key signs data and the public key verifies it.
liveBook manning.com

Hacking CryptographyA key pair consists of mathematically related public and private keys used together in asymmetric cryptography.
liveBook manning.com

Real-World CryptographyA key pair is a linked public key and private key used together in public-key cryptography.
liveBook manning.com

Build Python Web Apps with StreamlitA key pair is a matched private key and public key used for asymmetric authentication.
liveBook manning.com

Amazon Web Services in Action, Third Edition: An in-depth guide to AWSA key pair is a matching public key and private key used for asymmetric authentication to a system.

Compare how 6 books explain public-private key pair →

Related concepts

public keyhas part · A public key is the openly distributable component of an asymmetric cryptographic key pair, used for encryption, authentication, or signature verification.
private keyhas part · A private key is the secret component of an asymmetric cryptographic key pair used by its holder for operations such as authentication, decryption, or digital signing.
public key cryptographyused by · Public-key cryptography is asymmetric cryptography that uses mathematically related public and private keys for encryption, decryption, signing, and verification.
gpgproduced by · GPG is a command-line implementation of the OpenPGP standard for encryption, decryption, digital signatures, verification, and cryptographic key management.
security keyproduced by · A security key is a physical authentication device that uses cryptographic or challenge-response operations to prove possession during authentication.
key generationproduced by · Key generation is the process or algorithm that creates cryptographic key material, including public-key and private-key pairs.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.