{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/public-key-cryptography","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/public-key-cryptography/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/public-key-cryptography/"},"term":{"en":"Public-key cryptography","da":"Asymmetrisk kryptografi (public key)"},"aka":{"en":["asymmetric cryptography","asymmetric encryption"],"da":["public key-kryptografi","asymmetrisk kryptering"]},"domain":["cs"],"cluster":"cryptography","layer":"theory","status":"current","era":1976,"summary":{"en":"Encryption that uses a pair of keys - one shared openly, one kept private - so strangers can protect data for you without a shared secret.","da":"Kryptering med et nøglepar - én delt åbent, én holdt privat - så fremmede kan beskytte data til dig uden en fælles hemmelighed."},"body":{"formal":{"en":"A family of methods in which each party has a mathematically linked pair of keys; data locked with the public key can only be unlocked with the private key, and anything signed with the private key can be checked by anyone holding the public key.","da":"En familie af metoder, hvor hver part har et matematisk sammenhørende nøglepar; data låst med den offentlige nøgle kan kun låses op med den private nøgle, og alt signeret med den private nøgle kan tjekkes af alle, der har den offentlige nøgle."},"plain":{"en":"Like a mailbox with a slot - anyone can drop a letter in, but only the owner has the key to take letters out.","da":"Som en postkasse med en sprække - alle kan putte et brev i, men kun ejeren har nøglen til at tage brevene ud."},"inPractice":{"en":"A social worker in a municipality sends a case file by encrypted email to a hospital. Her mail program locks it with the hospital's public key, so only the hospital's private key can open it.","da":"En socialrådgiver i en kommune sender en sagsakt med krypteret mail til et hospital. Mailprogrammet låser den med hospitalets offentlige nøgle, så kun hospitalets private nøgle kan åbne den."},"whyItMatters":{"en":"It solves the problem of sharing a secret safely with strangers, and makes digital signatures possible, which is what lets people trust who is on the other end.","da":"Den løser problemet med at dele en hemmelighed sikkert med fremmede og gør digitale signaturer mulige - det er det, der gør, at man kan stole på, hvem der er i den anden ende."}},"deepDive":{"en":"Public-key cryptography rests on trapdoor problems: operations that are cheap in one direction and infeasible to reverse without a secret. RSA (Rivest, Shamir and Adleman, 1977) relies on the difficulty of factoring n = pq; Diffie-Hellman (1976) and its elliptic-curve form (ECC, proposed independently by Koblitz and Miller in 1985) rely on the discrete-logarithm problem. The ideas were discovered earlier at GCHQ by Ellis, Cocks and Williamson, but that work stayed classified until 1997. Because generic algorithms such as the number field sieve and Pollard's rho give shortcuts, key sizes are not comparable with symmetric ones: NIST SP 800-57 rates RSA-2048 at about 112 bits of security and needs RSA-3072 or a 256-bit curve such as P-256 or Curve25519 for 128 bits.\n\nIn practice public-key primitives are used for three jobs, never for bulk data: key establishment (ECDHE in TLS 1.3, X25519 per RFC 7748), key transport or encapsulation (RSA-OAEP, and key-encapsulation mechanisms), and digital signatures. Real systems are hybrid: an asymmetric step agrees on or transports a random symmetric key, and AES-GCM or ChaCha20-Poly1305 encrypts the payload. TLS 1.3 removed static RSA key transport entirely, so every handshake uses ephemeral Diffie-Hellman and gets forward secrecy.\n\nTextbook RSA is insecure: it is deterministic and malleable, so padding is mandatory. PKCS#1 v1.5 encryption padding enabled Bleichenbacher's 1998 adaptive chosen-ciphertext attack, which reappeared in TLS stacks as ROBOT in 2017; OAEP is the safe choice where RSA encryption is still used. Elliptic-curve implementations must validate that received points lie on the curve to avoid invalid-curve attacks, and all implementations must be constant-time to resist timing and cache side channels.\n\nShor's algorithm would break RSA, finite-field DH and ECC in polynomial time on a sufficiently large fault-tolerant quantum computer, and \"harvest now, decrypt later\" makes this a present concern for long-lived confidential data. NIST published the first post-quantum standards in August 2024: FIPS 203 (ML-KEM, a lattice-based key-encapsulation mechanism), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Deployment is hybrid for now, for example the TLS key-exchange group X25519MLKEM768 combining classical and post-quantum secrets, and the draft NIST IR 8547 (November 2024) proposes deprecating quantum-vulnerable algorithms at the 112-bit level after 2030 and disallowing all of them after 2035. A persistent misconception is that the public key authenticates its owner by itself; without a certificate, a pinned key or out-of-band verification, a man in the middle can simply substitute their own public key, which is the problem PKI exists to solve.","da":"Asymmetrisk kryptografi bygger på trapdoor-problemer: operationer, der er billige i én retning og praktisk umulige at vende om uden en hemmelighed. RSA (Rivest, Shamir og Adleman, 1977) hviler på, at det er svært at faktorisere n = pq; Diffie-Hellman (1976) og varianten på elliptiske kurver (ECC, foreslået uafhængigt af Koblitz og Miller i 1985) hviler på det diskrete logaritmeproblem. Ideerne blev opdaget tidligere hos GCHQ af Ellis, Cocks og Williamson, men arbejdet var hemmeligstemplet indtil 1997. Fordi generiske algoritmer som number field sieve og Pollards rho giver genveje, kan nøglestørrelser ikke sammenlignes med symmetriske: NIST SP 800-57 vurderer RSA-2048 til ca. 112 bits sikkerhed og kræver RSA-3072 eller en 256-bit kurve som P-256 eller Curve25519 for 128 bit.\n\nI praksis bruges asymmetriske primitiver til tre opgaver, aldrig til store datamængder: nøgleaftale (ECDHE i TLS 1.3, X25519 efter RFC 7748), nøgletransport eller -indkapsling (RSA-OAEP og key-encapsulation mechanisms) og digitale signaturer. Virkelige systemer er hybride: et asymmetrisk trin aftaler eller transporterer en tilfældig symmetrisk nøgle, og AES-GCM eller ChaCha20-Poly1305 krypterer selve indholdet. TLS 1.3 fjernede statisk RSA-nøgletransport helt, så hvert håndtryk bruger flygtig Diffie-Hellman og opnår forward secrecy.\n\nLærebogs-RSA er usikker: den er deterministisk og formbar, så padding er obligatorisk. Krypteringspaddingen i PKCS#1 v1.5 muliggjorde Bleichenbachers adaptive chosen-ciphertext-angreb fra 1998, som dukkede op igen i TLS-implementeringer som ROBOT i 2017; OAEP er det sikre valg, hvor RSA-kryptering stadig bruges. Implementeringer af elliptiske kurver skal kontrollere, at modtagne punkter ligger på kurven, for at undgå invalid curve-angreb, og alle implementeringer skal køre i konstant tid for at modstå timing- og cache-sidekanaler.\n\nShors algoritme vil kunne bryde RSA, Diffie-Hellman over endelige legemer og ECC i polynomiel tid på en tilstrækkeligt stor fejltolerant kvantecomputer, og \"harvest now, decrypt later\" gør det til et aktuelt problem for fortrolige data med lang levetid. NIST udgav de første post-kvante-standarder i august 2024: FIPS 203 (ML-KEM, en gitterbaseret key-encapsulation mechanism), FIPS 204 (ML-DSA) og FIPS 205 (SLH-DSA). Udrulningen er foreløbig hybrid, fx TLS-nøgleudvekslingsgruppen X25519MLKEM768, der kombinerer klassiske og post-kvante-hemmeligheder, og udkastet NIST IR 8547 (november 2024) foreslår, at kvantesårbare algoritmer på 112-bit-niveau udfases efter 2030, og at alle kvantesårbare algoritmer forbydes efter 2035. En sejlivet misforståelse er, at den offentlige nøgle i sig selv autentificerer ejeren; uden et certifikat, en pinnet nøgle eller verifikation ad anden vej kan en mand i midten blot udskifte den med sin egen, og det er netop det problem, PKI findes for at løse."},"edges":[{"type":"requires","to":"cs/cryptographic-key","confidence":"high","strength":"normal"},{"type":"kind-of","to":"cs/encryption","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"cs/symmetric-encryption","why":{"en":"Symmetric encryption uses one shared key for both locking and unlocking; public-key cryptography uses a linked pair, so no secret has to be shared first.","da":"Symmetrisk kryptering bruger én fælles nøgle til både at låse og låse op; asymmetrisk kryptografi bruger et nøglepar, så ingen hemmelighed skal deles først."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"cs/tls","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"Paar & Pelzl, Understanding Cryptography","tier":"textbook"},{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"}],"draft":true}