Asymmetric Cryptography

Overview

Asymmetric Cryptography is cryptography that uses a mathematically related public and private key pair for digital signatures, key establishment, encryption, or identity verification. Its operational purpose is to allow parties to verify signatures or protect communications without sharing the private key. It should be considered alongside Private Key Exposure. The relevant distinction is symmetric cryptography, which uses the same shared secret or closely related secret material for encryption and decryption.

A typical workflow is as follows: A secure process generates a key pair, protects the private key, distributes or certifies the public key, performs signing, verification, encryption, or key agreement, and manages rotation, revocation, and retirement.

Core controls include approved algorithms and parameters, strong random generation, hardware protection, certificate validation, key usage separation, access control, backup, rotation, compromise response, and cryptographic agility.

In payment and crypto operations, Blockchain wallets use private keys to authorize transactions and public keys or derived addresses to verify control. Digital signatures can also authenticate APIs, webhooks, documents, and software.

Evidence should include algorithm, key identifier, public key or certificate, usage, creation and expiry, protection level, signature or verification result, rotation, revocation, and incident history. Security fails if the private key is exposed, the public key is substituted, or obsolete algorithms and parameters are accepted.

A production treatment of Asymmetric Cryptography should test the use of a mathematically related public and private key pair for digital signatures, key establishment, encryption, or identity verification within the relevant asset, decision, or service state. The Asymmetric Cryptography context record for key establishment, encryption, and identity verification should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Asymmetric Cryptography should determine whether safeguards addressing key establishment, encryption, and identity verification changed exposure in practice, not merely whether a document or setting existed.