Home > Security and Compliance Blog > CMMC Compliance > Cryptography 101: Public Key, Private Key, and How They Work Together

Cryptography 101: Public Key, Private Key, and How They Work Together

by Bob Ertl updated June 30, 2025 CMMC Compliance

Reading Time: 11 minutes

Cryptography is a crucial aspect of modern technology that ensures secure communication and data protection. It involves the use of complex mathematical algorithms to encrypt and decrypt information. At the core of cryptography lie two fundamental concepts: public key and private key. Understanding how these keys work together is essential to grasp the intricacies of modern encryption techniques.

Cryptography is critical requirement for demonstrating CMMC compliance. And while the CMMC certification process can be arduous, our CMMC 2.0 compliance roadmap can help.

Table of Contents

Understanding Cryptography: A Brief Overview

Cryptography has evolved over the centuries, adapting to the changing needs of society. Its importance in today’s digitized world cannot be overstated. From online banking to secure messaging apps, cryptography is the backbone of secure communication.

CMMC 2.0 Compliance Roadmap for DoD Contractors

Read Now

Cryptography is built upon the basic principles of confidentiality, integrity, and authentication. By encrypting data, cryptography ensures that only authorized parties can access and understand the information. It also provides a means to verify the integrity of the data and authenticate the identity of the sender.

Why Cryptography Matters

In an era where data breaches and cyberattacks are a constant threat, cryptography plays a pivotal role in safeguarding sensitive information. It protects financial transactions, secures confidential emails, and enables secure online browsing. Without cryptography, our digital lives would be incredibly vulnerable.

One of the key reasons why cryptography is so important in today’s digital age is the increasing reliance on technology for various aspects of our lives. From online shopping to social media, we constantly share personal information over the internet. Without proper encryption, this information would be exposed to potential hackers and malicious actors.

Furthermore, cryptography is essential for protecting the privacy of individuals and organizations. It ensures that sensitive data, such as medical records or trade secrets, remains confidential and inaccessible to unauthorized individuals.

As technology advances, so do the methods used to break encryption. Cryptographers constantly strive to develop stronger algorithms and encryption methods to stay ahead of potential attackers. This ongoing battle between cryptographers and hackers fuels innovation in the field of cryptography, leading to the development of more secure and robust encryption techniques.

The Basic Principles of Cryptography

At its core, cryptography relies on two types of keys: public key and private key. These keys form the foundation of secure communication and data protection.

The public key is available to anyone and is used for encryption. It allows anyone to encrypt a message that can only be decrypted by the corresponding private key. This ensures that only the intended recipient, who possesses the private key, can access the encrypted information.

The private key, on the other hand, is kept secret and is used for decryption. It is known only to the recipient and is used to decrypt the encrypted message received using the public key.

This asymmetric encryption scheme provides a secure method of communication, as even if the public key is intercepted, the encrypted message cannot be decrypted without the private key.

In addition to encryption and decryption. Hashing is a process that takes an input and produces a fixed-size string of characters, which is unique to that input. This technique is commonly used to verify the integrity of data, as even a small change in the input would result in a completely different hash value.

Digital signatures, on the other hand, are used to authenticate the identity of the sender and ensure the integrity of the message. They involve the use of the sender’s private key to encrypt a hash value of the message. The recipient can then use the sender’s public key to decrypt the hash value and compare it with the calculated hash value of the received message. If the two values match, it provides assurance that the message has not been tampered with and that it was indeed sent by the claimed sender.

Diving into Public Key Cryptography

Public key cryptography, also known as asymmetric cryptography, is a revolutionary concept that transformed the field of encryption. Unlike traditional symmetric cryptography, which relies on a shared secret key, public key cryptography uses a pair of mathematically related keys: the public key and the private key.

The Concept of Public Key

A public key is openly shared and can be freely distributed. It is used to encrypt data intended for a specific recipient. While the public key can be used for encryption, it cannot be used to decrypt the encrypted data.

Public key cryptography is based on the concept of mathematical functions that are easy to compute in one direction, but computationally infeasible to reverse. This means that while it is easy to encrypt data using the public key, it is extremely difficult to decrypt it without the corresponding private key.

The public key is derived from the private key using complex mathematical algorithms. These algorithms ensure that the relationship between the two keys is one-way, meaning that it is easy to compute the public key from the private key, but virtually impossible to compute the private key from the public key.

The Role of Public Key in Encryption

When someone wants to send a confidential message to a recipient, they use the recipient’s public key to encrypt the message. Once encrypted with the public key, only the corresponding private key, held solely by the recipient, can decrypt the message and reveal its contents.

By utilizing a recipient’s public key, anyone can send them secure messages without needing to establish a shared secret key in advance. This makes public key cryptography highly efficient for secure communication.

In addition to encryption, public key cryptography also enables digital signatures. A digital signature is created by encrypting a hash of the message using the sender’s private key. The recipient can then verify the authenticity of the message by decrypting the digital signature using the sender’s public key and comparing it to the calculated hash of the received message.

This process ensures that the message has not been tampered with during transmission and that it was indeed sent by the claimed sender. Digital signatures provide a way to verify the integrity and authenticity of electronic documents, making public key cryptography an essential tool for secure communication and online transactions.

Public key cryptography has numerous applications in various fields, including secure email communication, secure web browsing, digital certificates, and secure online transactions. It has revolutionized the way we protect sensitive information and ensure the privacy and security of our digital communications.

Exploring Private Key Cryptography

Private key cryptography, also known as symmetric cryptography or secret key encryption, relies on a single shared secret key for both encryption and decryption purposes. The same key is used to encrypt the data at the sender’s end and decrypt it at the recipient’s end.

The Concept of Private Key

A private key is kept secret and known only to the intended recipient. It is used to decrypt data that has been encrypted with the corresponding public key.

In private key cryptography, the private key plays a crucial role in ensuring the security and confidentiality of the encrypted information. It is a unique and secret piece of information that is generated and securely stored by the recipient. The private key is mathematically linked to the corresponding public key, forming a key pair.

When data needs to be encrypted and sent to the recipient, the sender uses the recipient’s public key to encrypt the data. The encrypted data can only be decrypted using the recipient’s private key, which is known only to the recipient. This ensures that only the intended recipient can access and read the decrypted information.

The Role of Private Key in Decryption

Private key cryptography ensures that only authorized recipients, possessing the correct private key, can decrypt and access the encrypted information. This makes it suitable for scenarios where a small group of trusted individuals need to exchange secure messages.

When the encrypted data reaches the recipient, the recipient uses their private key to decrypt the data. The private key is applied to the encrypted data, reversing the encryption process and transforming the data back into its original form. This allows the recipient to access and understand the information that was sent to them.

Private key cryptography provides a secure and efficient method of communication between trusted parties. The use of a shared secret key simplifies the encryption and decryption process, making it faster and more practical for real-time communication.

It is important to note that the security of private key cryptography relies heavily on the protection of the private key itself. If the private key falls into the wrong hands, unauthorized individuals could decrypt and access the encrypted information. Therefore, it is essential to implement strong security measures to safeguard the private key and prevent unauthorized access.

In conclusion, private key cryptography is a fundamental concept in the field of information security. It allows for secure communication and data exchange between trusted parties, ensuring that only authorized recipients can access and decrypt the encrypted information. By understanding the role and importance of private keys, individuals and organizations can implement robust security measures to protect their sensitive data.

The Symbiotic Relationship Between Public and Private Keys

Public key cryptography and private key cryptography complement each other to offer a robust system of secure communication.

How Public and Private Keys Work Together

The public and private keys are mathematically related, allowing data encrypted with the public key to be decrypted with the corresponding private key. This relationship forms the foundation of secure communication and data protection.

The Process of Encryption and Decryption

When sending a confidential message, the sender encrypts the message using the recipient’s public key. The recipient then uses their private key to decrypt the message and view its contents. This process ensures that only the intended recipient can access the sensitive information.

Public Key vs. Private Key: Key Differences

Visibility and Distribution: The public key is designed to be shared openly with anyone. The private key, as its name implies, must be kept strictly confidential and secure by its owner. There are many different types of keys in cryptography, but this is the most fundamental distinction.
Primary Function: A public key is used to encrypt data and verify digital signatures. Its corresponding private key is used to decrypt that data and create digital signatures.
Ownership and Control: While many people may have a copy of your public key, only you should ever possess and control your private key.
Security Impact of Compromise: If a public key is compromised, the impact is minimal. However, a compromised private key is a severe security breach that can lead to data theft, impersonation, and loss of trust.
CMMC Compliance Implications: CMMC places stringent requirements on the protection of cryptographic keys. Securing the private key through robust access controls, secure storage, and proper lifecycle management is a non-negotiable aspect of protecting Controlled Unclassified Information (CUI).

Understanding these distinctions is the first step; next, we will explore the common algorithms that put these keys to work.

Common Algorithms in Public and Private Key Cryptography

Various algorithms are used in public and private key cryptography to ensure secure encryption and decryption.

RSA Algorithm: A Popular Choice

The RSA algorithm, named after its inventors Ron Rivest, Adi Shamir, and Leonard Adleman, is widely used in modern cryptography. It employs the use of large prime numbers and modular arithmetic to encrypt and decrypt data. The security of RSA lies in the difficulty of factoring large prime numbers.

Understanding the Diffie-Hellman Key Exchange

The Diffie-Hellman key exchange algorithm enables two parties to securely establish a shared secret key over an insecure channel. It is a vital component of secure communication protocols, such as SSL/TLS, ensuring that data exchanged between parties remains confidential.

Real-World Applications of Public and Private Key Encryption

Secure Email (S/MIME and PGP): A sender uses the recipient’s public key to encrypt an email, ensuring confidentiality. The sender can also sign the email with their own private key, which provides the recipient with proof of origin (authentication) and assurance that the message wasn’t altered (integrity).
VPN Tunnels (IPsec and TLS): Before establishing a secure tunnel, VPNs use public key cryptography to authenticate the endpoints (e.g., your computer and the company server) and securely exchange a symmetric key that will be used for fast, bulk encryption of the session data.
Digital Signatures: This provides non-repudiation. By signing a document with a private key, the signer cannot later deny their action. Anyone with the public key can verify the signature, confirming both the signer’s identity and the document’s integrity.
Cryptocurrency Wallets: A cryptocurrency wallet’s address is derived from a public key, allowing others to send funds to it. However, only the person holding the corresponding private key can authorize transactions to spend those funds.
Secure Software Updates: To prevent malware distribution, software developers sign their updates with a company private key. Your operating system then uses the developer’s public key to verify the signature before installation, ensuring the update is authentic.
Zero-Trust Authentication: In a zero-trust architecture, identity is paramount. Public key infrastructure (PKI) is used to issue certificates to users and devices, enabling strong, continuous authentication without relying on traditional network perimeters.

For organizations handling sensitive data, especially those subject to CMMC, managing these applications securely is critical. A platform like Kiteworks provides a Private Data Network where these cryptographic principles are applied through robust Kiteworks encryption, ensuring that secure file sharing, secure email, secure managed file transfer, and other data transfers are protected with end-to-end encryption and auditable controls.

Public Key Cryptography Standards (PKCS)

Public Key Cryptography Standards (PKCS) are a suite of specifications created by RSA Security to promote the interoperability of systems using public key cryptography. These standards define formats for cryptographic information, ensuring that different applications can securely exchange keys, certificates, and signed data.

Widely used standards include PKCS #1 (defining the mathematical properties and format for RSA keys), PKCS #7 (defining a syntax for signed or encrypted data), and PKCS #12 (defining a file format for storing and transporting a user’s entire personal identity, including their private key and public certificate).

Adherence to these standards is vital for achieving cryptographic module validation under FIPS 140-2, a core requirement for many government systems and a foundational element for CMMC compliance.

How TLS/SSL Uses Public Key Cryptography

Transport Layer Security (TLS), the successor to SSL, uses public key cryptography to establish trust and secure network connections, most notably for HTTPS web traffic.

The process begins with the “TLS handshake,” where a server presents its digital certificate to the client. This certificate contains the server’s public key and is signed by a trusted Certificate Authority (CA), verifying the server’s identity. The client then uses public key cryptography to securely negotiate a shared symmetric key with the server.

To answer the question, “what is the term for the prevailing method via which public-key (i.e., asymmetric) cryptography enables two parties to establish a shared secret, even over an insecure (i.e., unencrypted) channel?,” the answer is a key exchange mechanism like the Diffie-Hellman key exchange.

Once this shared secret is established, the rest of the session is encrypted using faster symmetric algorithms. For frameworks like CMMC, enforcing strong TLS versions (1.2 or higher) and secure cipher suites is mandatory for protecting CUI in transit, a security posture that platforms like Kiteworks manage by default to ensure compliance.

Kiteworks Helps Organizations Protect Sensitive Content with Best-in-Class Encryption

Cryptography is a fascinating field that underpins the security of our digital lives. Public key and private key cryptography work hand in hand to ensure secure communication and data protection. By understanding the principles and algorithms behind cryptography, we can appreciate the effort that goes into keeping our digital world secure.

The Kiteworks Private Data Network, a FIPS 140-2 Level validated secure file sharing and file transfer platform, consolidates email, file sharing, web forms, SFTP and managed file transfer, so organizations control, protect, and track every file as it enters and exits the organization.

Kiteworks provides robust encryption capabilities to ensure the security and integrity of an organization’s data. Kiteworks emails are encrypted and decrypted automatically and seamlessly, and recipients use their native email accounts. All files undergo an integrity check using an MD5 hash digital fingerprint and all content is sent over an encrypted SSL connection, with the ability to disable TLS 1.0 or 1.1 for enhanced security.

Kiteworks also offers advanced encryption that’s received FIPS 140-3 Level 1 validation.

Encryption is a key requirement for defense contractors and subcontractors who must demonstrate CMMC compliance to continue working with the US Department of Defense (DoD). Kiteworks supports nearly 90% of CMMC Level 2 requirements out of the box. As a result, DoD contractors and subcontractors can accelerate their CMMC Level 2 accreditation process by ensuring they have the right sensitive content communications platform in place to achieve CMMC 2.0 compliance.

With Kiteworks, DoD contractors and subcontractors unify their sensitive content communications into a dedicated Private Data Network, leveraging automated policy controls and tracking and cybersecurity protocols that align with CMMC 2.0 practices.

Kiteworks enables rapid CMMC 2.0 compliance with core capabilities and features including:

Certification with key U.S. government compliance standards and requirements, including SSAE-16/SOC 2, NIST 800-171, and NIST 800-172 and supporting SOC2 compliance, FedRAMP compliance, NIST 800-171 compliance, and more.
FIPS 140-3 Level 1 validation
FedRAMP Authorized for High and Moderate Impact Level CUI
AES 256-bit encryption for data at rest, TLS 1.2 for data in transit, and sole encryption key ownership

Kiteworks deployment options include on-premises, hosted, private, hybrid, and FedRAMP virtual private cloud. With Kiteworks: control access to sensitive content; protect it when it’s shared externally using automated end-to-end encryption, multi-factor authentication (MFA), and security infrastructure integrations; see, track, and report all file activity, namely who sends what to whom, when, and how. Finally adhere to data privacy regulations and standards to achieve GDPR compliance, HIPAA compliance, CMMC 2.0 compliance, GxP compliance, CJIS compliance, IRAP compliance, and many more.

To learn more about Kiteworks, schedule a custom demo today.

Additional Resources