Cryptographic Key Pair

When two people want to send each other messages so that no one else can read along, they need a secret. In the past, this was a single password that both knew. That has an obvious drawback: it first has to be exchanged securely. A cryptographic key pair solves this problem. It consists of two very long sequences of numbers that are mathematically related. One, the public key, may be seen by everyone; the other, the private key, stays with the owner forever. Whatever was locked with one sequence of numbers can only be opened by the other – and vice versa.

Why a secret password alone is not enough

Imagine a mailbox with a slot. Anyone can drop something in, but only you have the key to the flap. That’s exactly how a key pair works: the public key is the slot, which you can publish anywhere. The private key is the key to the flap. No one needs to agree on a shared secret with you beforehand.

This is the reason online banking or messaging apps are possible at all. You’ve never met your bank, yet you’ve never whispered a password to it either. When establishing a connection, the server sends its public key, your browser checks it, and both sides negotiate a session key from it. The trick: an eavesdropper sees the entire exchange and still can’t do anything with it.

The second major benefit is the digital signature. Here the direction is reversed: you sign with your private key, and anyone can verify the signature with the public key. This makes it possible to prove that a file really came from you and wasn’t altered along the way. Software updates, identity documents, and cryptocurrency transfers all rely on this principle.

The mathematics behind the two numbers

Both keys are generated simultaneously from a very large random number. This uses mathematical operations that are easy in one direction and practically impossible in the other. A classic example: multiplying two large prime numbers is easy. Finding the two factors again from the result can cost even supercomputers millions of years. Such mathematical one-way streets are called one-way functions.

That’s why the public key can be handed out without risk. It doesn’t reveal the private key, even though it’s derived from it. Common methods are called RSA and ECDSA. Depending on the method, modern keys are 256 to 4096 bits long, meaning 256 to 4096 zeros and ones. Shorter keys are now considered insecure, because computing power gets cheaper over the years.

A common misconception: large amounts of data are rarely encrypted directly with the key pair, since that would be too slow. Instead, the pair only secures the exchange of a short, fast key for the actual encryption. It’s also important to note: a lost private key cannot be reset. There is no authority that holds a copy – unlike with a forgotten password.

From the padlock icon in the browser to the crypto wallet

You most often encounter a key pair without noticing it. Every time an address begins with “https,” such keys are working in the background. WhatsApp and Signal also generate a pair for each device, so that only sender and recipient can read along. Programmers use key pairs to log in to servers without a password.

In financial news, key pairs come up mainly in connection with cryptocurrencies. A Bitcoin address is essentially a public key, and the balance belongs to whoever holds the matching private key. This is where the phrase “not your keys, not your coins” comes from: whoever leaves their coins on an exchange gives up the keys. Reports of lost millions almost always involve lost or stolen private keys.

The topic also plays a role in the world of AI. Access to models runs through keys, and providers are working on signatures that can prove artificially generated images are indeed artificial. There’s also discussion of how long today’s methods will hold up. Should quantum computers ever become large enough, they could break some one-way functions – this is what so-called post-quantum cryptography is working on.