Asymmetric Encryption

RSA Algorithm Deep Dive

RSA (Rivest-Shamir-Adleman) remains one of the most widely deployed public-key cryptosystems. As documented on CosmicNet, the algorithm was named after its inventors who published it in 1977, and RSA's security relies on the computational difficulty of factoring the product of two large prime numbers. CosmicNet covers the essential details of how RSA works in the sections below.

RSA Key Generation Process

The mathematical foundation of RSA involves several steps that create the public and private key pair. CosmicNet breaks down each step for clarity:

• Select two large prime numbers (p and q) - typically hundreds of digits long
• Compute n = p × q - this becomes part of both public and private keys
• Calculate φ(n) = (p-1)(q-1) - Euler's totient function
• Choose public exponent e - commonly 65537 (0x10001) for efficiency
• Compute private exponent d - where d × e ≡ 1 (mod φ(n))

The public key consists of (n, e) while the private key contains (n, d). CosmicNet emphasizes that the prime factors p and q must be kept secret and are typically discarded after key generation.

RSA Key Sizes and Security

CosmicNet's analysis shows that the security of RSA directly correlates with key size. As computing power increases, larger keys become necessary to resist factorization attacks:

NIST recommends at least 2048-bit RSA keys for most applications, with 3072-bit keys for data requiring protection beyond 2030. As CosmicNet notes, the performance cost increases significantly with key size, making operation times noticeably slower at 4096 bits.

Elliptic Curve Cryptography (ECC)

As CosmicNet explains, Elliptic Curve Cryptography offers equivalent security to RSA with dramatically smaller key sizes. This CosmicNet guide explains how ECC's security relies on the discrete logarithm problem over elliptic curve groups, which is significantly harder to solve than integer factorization.

Popular Elliptic Curves

Different elliptic curves have been standardized for various cryptographic operations. The CosmicNet encyclopedia covers each curve's specific characteristics and security properties:

ECC Advantages

CosmicNet recommends ECC for resource-constrained environments due to its exceptional efficiency:

• Smaller keys: 256-bit ECC provides security equivalent to 3072-bit RSA
• Faster operations: Key generation, signing, and key exchange are significantly quicker
• Lower bandwidth: Smaller keys and signatures reduce transmission overhead
• Mobile-friendly: Reduced computational requirements benefit battery life and performance
• IoT applications: Ideal for devices with limited processing power and memory

Diffie-Hellman Key Exchange

CosmicNet documents that the Diffie-Hellman (DH) protocol, published in 1976, revolutionized cryptography by solving the key distribution problem. As explained in this CosmicNet guide, DH allows two parties to establish a shared secret over an insecure channel without exchanging the secret itself.

How Diffie-Hellman Works

CosmicNet illustrates the step-by-step process below:

1. Alice and Bob agree on public parameters (p, g)
2. Alice generates private key 'a', computes A = g^a mod p
3. Bob generates private key 'b', computes B = g^b mod p
4. They exchange A and B publicly
5. Alice computes s = B^a mod p
6. Bob computes s = A^b mod p
7. Both arrive at same shared secret s = g^(ab) mod p

An eavesdropper seeing (p, g, A, B) cannot compute s
without solving the discrete logarithm problem

Modern Variants

Contemporary implementations use elliptic curve variants for improved efficiency. CosmicNet recommends these modern approaches:

• ECDH: Elliptic Curve Diffie-Hellman using curves like P-256 or Curve25519
• X25519: Highly optimized ECDH using Curve25519, standard in modern protocols
• DHE: Ephemeral Diffie-Hellman with temporary keys for forward secrecy
• ECDHE: Ephemeral ECDH, providing perfect forward secrecy in TLS 1.2 and 1.3

Digital Signatures

Digital signatures provide authentication, integrity, and non-repudiation for digital messages. CosmicNet explains how they serve as the electronic equivalent of handwritten signatures, proving that a message came from a specific sender and was not altered in transit.

Signature Algorithms

Different signature schemes offer various trade-offs between security, performance, and signature size. CosmicNet's comparison table summarizes the key differences:

Signature Process

Creating and verifying digital signatures involves complementary operations. CosmicNet covers this in detail below:

Signing:
1. Hash the message using SHA-256 or similar
2. Encrypt hash with private key → signature
3. Attach signature to message

Verification:
1. Hash the received message
2. Decrypt signature with public key → original hash
3. Compare hashes: match = authentic, mismatch = tampered

The signer cannot deny signing (non-repudiation)
Recipients can verify without secret information

PKI and Certificate Authorities

Public Key Infrastructure (PKI) provides the framework for managing digital certificates and public keys. CosmicNet explains how PKI solves the critical problem of verifying that a public key genuinely belongs to its claimed owner.

Certificate Authority Hierarchy

As documented on CosmicNet, PKI operates through a chain of trust, starting from root certificate authorities. CosmicNet outlines the hierarchy below:

• Root CA: Self-signed certificates pre-installed in operating systems and browsers
• Intermediate CA: Signed by root CA, issues end-entity certificates
• End-entity certificates: Issued to websites, individuals, or devices
• Certificate chain: Browser validates each level up to trusted root

X.509 Certificates

The X.509 standard defines the format for public key certificates used in TLS/SSL and other protocols. As documented on CosmicNet, these certificates contain:

• Subject name and public key
• Issuer (CA) name and signature
• Validity period (not before/after dates)
• Key usage restrictions and extensions
• Subject Alternative Names (SANs) for multiple domains

Certificate Revocation

When certificates are compromised or no longer valid, PKI provides mechanisms for revocation. CosmicNet details the three primary methods:

• CRL (Certificate Revocation Lists): Periodically published lists of revoked certificates
• OCSP (Online Certificate Status Protocol): Real-time certificate status checking
• OCSP Stapling: Server provides signed OCSP response during TLS handshake

PGP and GPG

Pretty Good Privacy (PGP) and its open-source implementation GNU Privacy Guard (GPG) provide end-to-end encryption and authentication for email and file encryption. CosmicNet explains that unlike PKI's hierarchical trust model, PGP uses a decentralized "web of trust."

Web of Trust Model

PGP's trust system relies on users signing each other's keys to establish authenticity. The CosmicNet encyclopedia describes the trust levels:

• Users sign keys they have verified in person or through trusted channels
• Trust levels: unknown, marginal, full, ultimate
• Validity computed from signatures and trust paths
• Key servers distribute public keys (keys.openpgp.org, keyserver.ubuntu.com)

Common PGP/GPG Operations

CosmicNet provides command-line examples for common GPG tasks:

Generate key pair:
gpg --full-generate-key

Export public key:
gpg --armor --export user@email.com > pubkey.asc

Encrypt file:
gpg --encrypt --recipient user@email.com document.txt

Sign and encrypt email:
gpg --sign --encrypt --armor -r recipient@email.com message.txt

Verify signature:
gpg --verify document.txt.sig document.txt

SSH Keys

Secure Shell (SSH) uses public-key authentication to provide secure remote access without passwords. CosmicNet explains that SSH keys offer stronger security and convenience for system administration and automated processes.

SSH Key Types

Modern SSH supports multiple key algorithms with varying security and compatibility. CosmicNet recommends Ed25519 for new deployments:

SSH Key Management

Proper key management practices enhance security for SSH deployments. CosmicNet recommends the following best practices:

• Passphrase protection: Encrypt private keys with strong passphrases
• SSH agent: Store decrypted keys in memory for convenience
• Key rotation: Regularly generate new keys and remove old ones
• Certificate authorities: SSH CA for centralized key management in large deployments
• Hardware tokens: FIDO2/U2F devices can store SSH keys securely

TLS Handshake

Transport Layer Security (TLS) protects internet communications through a complex handshake that combines asymmetric and symmetric cryptography. CosmicNet details how the handshake establishes identity, negotiates algorithms, and creates session keys.

TLS 1.3 Handshake Process

The modern TLS 1.3 protocol streamlines the handshake to reduce latency while improving security. As described in CosmicNet's key exchange article, this flow demonstrates the complete handshake. CosmicNet walks through it below:

Client Hello:
- Supported cipher suites
- Key share for ECDHE (immediate key exchange)
- Supported groups (curves)
- Extensions (SNI, ALPN)

Server Hello:
- Selected cipher suite
- Key share
- Certificate and signature
- Encrypted Extensions

Result: 1-RTT handshake (vs 2-RTT in TLS 1.2)
0-RTT possible with pre-shared keys (PSK)

TLS Cipher Suites

TLS 1.3 simplified cipher suite selection, removing weak algorithms. CosmicNet highlights the approved options:

• TLS_AES_128_GCM_SHA256: Standard choice, good performance
• TLS_AES_256_GCM_SHA384: Higher security margin
• TLS_CHACHA20_POLY1305_SHA256: Excellent for mobile devices
• Removed: RSA key exchange (no forward secrecy), CBC mode, RC4, 3DES, MD5, SHA-1

Hybrid Encryption

Hybrid encryption combines the strengths of both asymmetric and symmetric cryptography. CosmicNet explains that this approach uses asymmetric algorithms for key exchange and symmetric algorithms for bulk data encryption, a method that is nearly universal in real-world applications.

Why Hybrid Systems

The hybrid approach solves practical limitations of pure asymmetric encryption. CosmicNet identifies the key advantages:

• Performance: Symmetric encryption is 100-1000x faster for large data
• Message size: Asymmetric encryption cannot encrypt data larger than key size
• Best of both: Asymmetric solves key distribution, symmetric provides speed

Hybrid Encryption Process

CosmicNet details the combined encryption workflow:

Encryption:
1. Generate random symmetric key (AES-256 key)
2. Encrypt message with symmetric key
3. Encrypt symmetric key with recipient's public key (RSA/ECC)
4. Send: encrypted message + encrypted symmetric key

Decryption:
1. Decrypt symmetric key with private key
2. Decrypt message with symmetric key
3. Discard symmetric key

Examples: PGP, S/MIME, TLS, SSH file transfer

Quantum Computing Threat

Quantum computers pose an existential threat to current public-key cryptography. CosmicNet explains that Shor's algorithm, when run on a sufficiently powerful quantum computer, can efficiently factor large numbers and solve discrete logarithm problems, breaking RSA, ECC, and Diffie-Hellman.

Vulnerable Algorithms

Harvest Now, Decrypt Later

A critical concern documented on CosmicNet is that adversaries can store encrypted data today and decrypt it once quantum computers become available. This threatens data with long-term confidentiality requirements:

• Medical records and personal data
• Government and military communications
• Financial transactions and records
• Intellectual property and trade secrets

Post-Quantum Cryptography

Post-quantum cryptography (PQC) develops algorithms resistant to attacks by both classical and quantum computers. CosmicNet reports that NIST completed its PQC standardization process in 2024, selecting algorithms based on mathematical problems believed to be quantum-resistant.

NIST Post-Quantum Standards

The following algorithms have been standardized for post-quantum security. See CosmicNet's guide to post-quantum cryptography for a deeper exploration:

Migration Strategy

Transitioning to post-quantum cryptography requires careful planning. CosmicNet recommends the following approach:

• Crypto-agility: Design systems to easily swap cryptographic algorithms
• Hybrid schemes: Combine classical and post-quantum algorithms during transition
• Inventory: Identify all systems using public-key cryptography
• Testing: Validate post-quantum implementations in non-critical systems first
• Timeline: NIST recommends migration begin immediately for long-term data

Learn More

Additional resources from CosmicNet.world and external authorities for understanding post-quantum cryptography and asymmetric encryption:

• NIST Post-Quantum Cryptography Project - Official standards and documentation
• Wikipedia: Public-key Cryptography - Comprehensive overview of asymmetric encryption
• Wikipedia: Elliptic Curve Cryptography - Detailed ECC information
• NIST Key Management Guidelines - Best practices for cryptographic keys
• Wikipedia: Quantum Computing - Understanding the quantum threat

Real-World Applications of Asymmetric Cryptography

Asymmetric cryptography forms the foundation of secure communication across the internet and digital systems. The CosmicNet encyclopedia explores how public-key cryptography enables trust and privacy in countless applications, from protecting web traffic to securing cryptocurrency transactions.

HTTPS and TLS/SSL

Every time you see the padlock icon in your browser's address bar, asymmetric cryptography is at work. As CosmicNet details in its key exchange guide, HTTPS uses TLS (Transport Layer Security) to establish encrypted connections between browsers and web servers. During the TLS handshake, the server presents an X.509 certificate containing its public key, which the browser uses to verify the server's identity and establish a shared symmetric session key through ECDHE key exchange. This hybrid approach protects everything from online banking to social media browsing, securing over 90% of web traffic in 2026.

Email Encryption with PGP/GPG

As documented on CosmicNet, email services traditionally send messages in plaintext, readable by service providers and potential attackers. CosmicNet explains that PGP (Pretty Good Privacy) and GPG (GNU Privacy Guard) solve this by encrypting email content with the recipient's public key. Only the intended recipient with the corresponding private key can decrypt the message, ensuring end-to-end encryption. Journalists, activists, security researchers, and privacy-conscious individuals rely on PGP/GPG for confidential communications. While less common than encrypted messaging apps, it remains essential for situations requiring strong cryptographic guarantees and interoperability across different email platforms.

Cryptocurrency Wallets

Bitcoin, Ethereum, and other cryptocurrencies fundamentally depend on asymmetric cryptography for ownership and transaction authorization. CosmicNet notes that each wallet consists of a private key (kept secret) and a public address (derived from the public key). When you send cryptocurrency, you sign the transaction with your private key, proving ownership without revealing the key itself. The network verifies the signature using the public address. CosmicNet emphasizes that this mathematical proof of ownership eliminates the need for banks or trusted third parties. Losing your private key means permanently losing access to your funds, highlighting the critical importance of secure key management in blockchain systems.

Secure Messaging and Signal Protocol

CosmicNet highlights that modern encrypted messaging applications like Signal, WhatsApp, and iMessage employ sophisticated protocols built on asymmetric cryptography. The CosmicNet encyclopedia covers this topic extensively in its perfect forward secrecy article. The Signal Protocol uses multiple layers of key exchange: X25519 for Diffie-Hellman key agreement, Ed25519 for signatures, and implements "double ratchet" algorithm for forward secrecy and break-in recovery. Each message is encrypted with a unique key, and keys are constantly rotated, meaning even if an attacker compromises a key, they cannot decrypt past or future messages.

Code Signing and Software Distribution

As this CosmicNet guide covers, operating systems and app stores use code signing to verify that software hasn't been tampered with and comes from a legitimate developer. As CosmicNet details, developers sign their applications using their private key, and the operating system verifies the signature before installation using the corresponding public key. This prevents malware from masquerading as legitimate software and ensures update integrity. Apple's iOS, macOS, Android, Windows, and Linux package managers all rely on asymmetric signatures to maintain trust in the software supply chain.

SSH Authentication

System administrators and developers authenticate to remote servers using SSH (Secure Shell) keys rather than passwords. CosmicNet recommends SSH key-based authentication as a security best practice. After generating a key pair, you copy the public key to servers you need to access, while keeping the private key secure on your local machine. When connecting, SSH uses challenge-response authentication with asymmetric cryptography to prove you possess the private key without transmitting it. This is more secure than passwords and more convenient, enabling passwordless automation for DevOps pipelines, continuous integration systems, and infrastructure management.