Key pair

What is a key pair in simple words

A key pair is a set of two interrelated cryptographic keys: a public and a private one. It is used in asymmetric cryptography for data encryption and creation of electronic signatures.

Imagine a mailbox with two keys. The public key can be copied and given out to everyone who wants it — they can drop a letter into the box (encrypt a message), but only the private key, which only you have, can open it (decrypt it). This is the principle of how a key pair works.

Key pairs underlie all of modern digital security. They are used in SSL/TLS certificates for secure websites (HTTPS), in electronic signatures for confirming documents, in SSH for secure access to servers and in cryptocurrencies for confirming transactions. Read about how encryption works in the article Data encryption.

How a key pair works

A key pair is generated using mathematical algorithms that link the two keys together. Information encrypted with the public key can only be decrypted with the corresponding private key. And vice versa — information encrypted with the private key can be decrypted with the public key (this is used for digital signatures).

Two main applications

• Encryption: The sender encrypts the message with the recipient's public key. Only the recipient, who has the corresponding private key, can decrypt it. This guarantees confidentiality.
• Digital signature: The sender signs the document with their private key. The recipient can verify the signature using the sender's public key, confirming the authenticity of the document. Read about how digital signatures work in the article Electronic signature.

Public and private key

Public key

Distributed freely. Serves to encrypt information sent to you or to verify your digital signature. The public key can be published on websites, in letters, in open repositories — this is safe, because without the private key it is useless to attackers.

Example: you can place your public key on the company website so that clients can encrypt their messages before sending them to you. Read about how public keys are used in website security in the article Cryptographic information protection.

Private key

Kept in the strictest secrecy. Used to decrypt data that was encrypted with your public key, or to create a digital signature. Losing or compromising the private key means losing control over all protected information.

Private keys are often stored on secure physical media — tokens (for example, Rutoken, eToken) — and are protected by a PIN code. Read about how keys are stored in the article Certification authority.

Where a key pair is used

1. Electronic signature (ES)

The private key signs the document, and the public key confirms the authenticity of the owner's signature. This is the basis of electronic document management. Such keys are often stored on physical media — tokens (Rutoken, eToken).

2. SSL/TLS certificates

A key pair is used for secure connections (HTTPS). The public key is embedded in the website certificate, and the private key is stored on the server. This guarantees that the data between the browser and the server is encrypted and cannot be intercepted.

3. SSH access to servers

A key pair is used for secure login to remote servers and virtual machines (for example, in Linux) without entering a password. This is the standard for system administrators and DevOps engineers.

4. Cryptocurrencies and blockchain

In blockchain systems, a key pair is used to confirm transactions. The private key signs the transaction, and the public key allows the network to verify that the transaction was sent by the wallet owner. Read about how this works in the article Bitcoin.

Popular key pair generation algorithms

• RSA: One of the oldest and most common algorithms. Based on the complexity of factoring large numbers. Used in SSL/TLS, SSH, electronic signatures.
• ECC (Elliptic Curve Cryptography): A more modern algorithm based on the properties of elliptic curves. Provides the same strength as RSA, but with a smaller key size (a 256-bit ECC key is equivalent to a 3072-bit RSA key). Used in modern systems.
• GOST R 34.10: A Russian public key cryptography standard based on elliptic curves. Used in government systems and for electronic signatures in Russia. Read about Russian standards in the article Cryptographic information protection.