Asymmetric encryption, also called public-key cryptography, is a cryptographic method that uses a mathematically linked key pair: a public key that can be shared openly and a private key that only its owner holds. In cryptography it solves the problem that symmetric ciphers cannot: two parties who have never shared a secret can still communicate confidentially and verify each other’s identity.
Data encrypted with the public key can be decrypted only with the matching private key, and a signature created with the private key can be verified by anyone holding the public key. Its security rests on mathematical problems believed to be hard, such as factoring large integers or computing discrete logarithms on elliptic curves.
How asymmetric encryption works
Asymmetric encryption relies on a trapdoor one-way function: an operation that is easy to compute in one direction and practically impossible to reverse without a secret value. Key generation produces the private key first and derives the public key from it, so the public key reveals nothing practical about the private key.
In RSA, the public key consists of a modulus formed by multiplying two large primes and a public exponent, usually 65537. Recovering the private exponent requires factoring that modulus. In elliptic curve cryptography, the private key is a large random number and the public key is a curve point obtained by repeated point addition; reversing it requires solving the elliptic curve discrete logarithm problem.
The same key pair supports two distinct operations. Encryption with the recipient’s public key provides confidentiality, while signing with the sender’s private key provides authenticity and integrity. Modern practice uses separate algorithms and often separate keys for these purposes, because mixing them creates subtle vulnerabilities.
Main algorithms and key sizes
Key sizes in asymmetric cryptography are much larger than symmetric key sizes for the same security, because the underlying mathematical attacks are more efficient than brute force. The table summarizes common algorithms and their roles.
| Algorithm | Hard problem | Typical key size | Main use |
|---|---|---|---|
| RSA | Integer factorization | 2048 to 4096 bits | Encryption, signatures, legacy TLS |
| ECDH (X25519) | Elliptic curve discrete logarithm | 256 bits | Key exchange in TLS, SSH, messaging |
| ECDSA and Ed25519 | Elliptic curve discrete logarithm | 256 bits | Digital signatures |
| Diffie-Hellman (finite field) | Discrete logarithm | 2048 bits or more | Older key exchange |
| ML-KEM | Module lattice problems | Public keys around 800 to 1,600 bytes | Post-quantum key establishment |
| ML-DSA | Module lattice problems | Public keys around 1,300 to 2,600 bytes | Post-quantum signatures |
An RSA key of 3072 bits offers roughly the same strength as a 256-bit elliptic curve key and a 128-bit symmetric key. This efficiency gap is why elliptic curves dominate new designs: smaller keys, faster operations and shorter signatures.
Asymmetric versus symmetric encryption
Asymmetric and symmetric encryption are complementary rather than competing. Each has strengths that the other lacks, and nearly all real systems combine both.
| Property | Asymmetric encryption | Symmetric encryption |
|---|---|---|
| Keys | Public and private key pair | One shared secret key |
| Key distribution | Public key can be shared openly | Secret must be exchanged securely |
| Speed | Hundreds to thousands of times slower | Very fast, often hardware-accelerated |
| Data size | Small payloads only | Bulk data of any size |
| Signatures | Supports digital signatures | Only MACs with shared keys |
| Typical algorithms | RSA, X25519, Ed25519, ML-KEM | AES, ChaCha20 |
The standard combination is hybrid encryption: an asymmetric step establishes or protects a random symmetric key, and AES or ChaCha20 then encrypts the actual data. TLS, SSH, GPG and end-to-end encrypted messaging all follow this pattern.
Where asymmetric encryption is used
Public-key cryptography underpins trust on the modern internet. Its applications differ in which operation they use and how public keys are trusted.
| Application | Operation used | How public keys are trusted |
|---|---|---|
| TLS for HTTPS | Key exchange and certificate signatures | Certificate authorities in a PKI |
| SSH | Key exchange and user authentication | Known hosts and authorized keys |
| Email encryption with GPG or S/MIME | Hybrid encryption and signatures | Web of trust or certificates |
| Code signing | Signatures on software releases | Vendor certificates or published keys |
| Passkeys and FIDO2 | Challenge signatures | Key registered per website |
The common thread is the trust model for public keys. Encryption to a public key protects nothing if an attacker substituted that key, so every application needs a way to confirm ownership. A public key infrastructure delegates this to certificate authorities, while SSH and messaging apps rely on fingerprints that users or administrators verify directly.
Another important property is forward secrecy. When each session uses fresh, temporary key pairs that are discarded afterward, the later theft of a long-term private key does not expose earlier sessions. TLS 1.3 makes this behavior mandatory for its standard handshakes.
Limitations, pitfalls and the quantum threat
The mathematics is rarely what fails. Practical breaches result from poor key management, weak randomness and incorrect implementation.
- Textbook RSA without padding is insecure; use OAEP for encryption and PSS for signatures.
- Reusing or predicting the per-signature nonce in ECDSA reveals the private key.
- A public key is only useful if it is authentically bound to its owner, which is the role of certificates and fingerprints.
- Private keys stored unencrypted on servers or laptops undermine every other safeguard.
A sufficiently large quantum computer running Shor’s algorithm would break RSA, Diffie-Hellman and elliptic curve schemes. Because encrypted traffic can be recorded today and decrypted later, organizations are moving toward post-quantum cryptography, often in hybrid modes such as X25519 combined with ML-KEM, which remain secure if either component holds.
Stripped to the essentials
Asymmetric encryption works like a mailbox with a slot. Anyone can drop a letter through the slot, which corresponds to the public key, but only the owner has the key that opens the box, which corresponds to the private key.
Because the slot can be shown to the whole world, two people do not need to meet first to agree on a secret. The same idea also lets someone sign a message in a way that anyone can check but nobody else can forge.
Where it is applied
When a customer opens an online banking site, the browser and server perform a TLS 1.3 handshake. Each side generates a temporary X25519 key pair, they exchange public keys, and both compute the same shared secret without ever transmitting it. The server proves its identity with a signature from its certificate’s private key, which the browser verifies through the certificate chain.
The shared secret is turned into AES-GCM keys, and all account data then travels under fast symmetric encryption. The whole asymmetric step takes only milliseconds, yet it lets two machines that never met establish a private, authenticated channel, and because the temporary keys are discarded, recorded traffic stays protected even if the server’s long-term key is stolen later.