All that You Need To Know About Public Key Encryption

Wireless security has never been more critical. In the United States alone, the FBI received over one million cybercrime complaints in 2025, for a total of nearly $21 billion in reported losses. Organizations have to secure their data by protecting its digital assets, including server access, user authentication, and safe communication protocols.

Public-key encryption is the best option for authenticating users with digital X.509 certificates. The SecureW2 turnkey PKI lets administrators deploy certificate-based security in hours, not months, with no forklift upgrades required.

What is PKI Encryption?

PKI encryption is a method of protecting information that is either shared through an open channel on the web or stored on a device or on the cloud.  It’s based on a one-way function which is easy to compute but difficult to invert. Those one-way functions generate the pair of public and private keys used to encrypt and decrypt data.

This method is also known as asymmetric encryption, as opposed to the more vulnerable symmetric encryption, which only relies on a shared key. In asymmetric encryption, one key encrypts and the other decrypts, implementing a stronger security measure than just one key that does both.

The public key is shared to encrypt data. Anyone can send encrypted data to the recipient using the public key, which is why it’s called “public”; however, only the private key owner will be able to decrypt the data.

Public key cryptography is widely used today for securing web traffic and for network security protocols. It puts the “S” in “HTTPS”.

What Is Private Key Encryption?

Private key encryption, or symmetric cryptography, uses the same key to encrypt and decrypt data. The security of this kind of cryptosystem relies heavily on key management and  key length: the longer the key the safer the cryptosystem.

Today’s encryption algorithms are hybrid cryptosystems, using both symmetric and asymmetric encryption. For the most part, private key encryption is used to securely share keys generated by a public-key protocol.

Public Keys vs Private Keys

Public and private keys are closely linked, but they perform opposite functions. The public key is made available to the public, so that anyone can use it to encrypt messages intended for the key owner. The private key is kept secret and is the only key that can decrypt those messages. As long as the private key stays secure, sharing the public key carries no risk.

In order to maintain security, attackers must never be able to derive the private key from the public key. This is why all public-key cryptosystems are based on difficult mathematical problems with high computational complexity.

It’s also vital to keep the private key secret, both when it’s generated and stored. The random numbers used for the algorithms in cryptography must be difficult to guess, which is why it is not a good option to rely only on software programs for key generation.

Software cannot generate truly random numbers; it only can achieve a pseudo-randomness, which is not secure. Instead, it is recommended to use hardware devices, like a Hardware Security Module (HSM), which can achieve a higher degree of randomness for generating and storing private keys.

Public Keys and Digital Certificates

Public key cryptography allows organizations to issue certificates and verify a user’s identity with a digital signature. In this case, the keys have a different function from that of encrypting and decrypting.

In a digital signature, the private key is responsible for digitally signing documents and authenticating identities. The public key is meant to verify the signature and confirm the sender’s identity.

Digital certificates are cryptographic documents that can serve as user IDs for authentication purposes. Certificate Authorities (CA) serve as trusted agents to publish public keys that are linked to the private keys of approved network users. CAs create certificates by signing certificate signing requests (CSR) with their private keys.

Users can present their credentials with their public key and the authority will generate a certificate, input their credentials, sign it with its private key, and the user is now given an approved certificate.

When a user wants to encrypt a message, the CA ensures they are using the right public key and the message will get to its intended target. CAs also sign digital certificates, stamping them with a mark of approval so they can be installed on network devices and simplify user authentication.

What Is a PKI?

A PKI is a setup where users’ public keys are stored on public servers and made available in an online directory. PKIs handle the issuance, management, revocation, and distribution of digital certificates, just to name a few. Digital certificates and CAs make up part of the PKI and need it to operate effectively.

SecureW2 offers a Managed Cloud PKI, a turnkey solution that provides an organization everything they need to use PKI encryption for their network security.  Easily generate your own CAs and Certificate Revocation Lists, issue custom certificates through our robust policy engine, create auto-enrollment APIs, and much more.

SecureW2 is also ISO 27001 certified and backed by a powerful HSM to keep your private keys locked tight. The SecureW2 PKI also offers the only last mile certificate delivery platform, as users can use our software to self-service themselves and install certificates for BYODs, managed devices, smart cards, IoTs, and email clients.

What is PKI Encryption Used For?

PKI encryption is the foundation of secure communication across nearly every digital channel organizations rely on. Common use cases include:

• HTTPS and web security: Every HTTPS connection uses PKI encryption — the TLS handshake authenticates the server’s identity using a digital certificate before any data is exchanged.
• Email encryption and signing: PKI enables S/MIME email encryption and digital signatures, confirming both the sender’s identity and message integrity.
• VPN authentication: Certificate-based VPN authentication replaces shared passwords with device certificates, preventing credential-based attacks at the tunnel level.
• 1X Wi-Fi authentication: PKI certificates authenticate users and devices to WPA2/WPA3 Enterprise networks, eliminating the need for shared passwords entirely.
• Code signing: Software publishers sign executables and packages with their private key, allowing operating systems to verify authenticity before installation.

Why is PKI Encryption Important?

Password-based authentication carries an inherent weakness: passwords can be guessed, phished, reused, or leaked. PKI encryption eliminates that attack surface by replacing passwords with cryptographic certificates that cannot be guessed or replicated.

Certificate-based authentication also provides mutual verification — not just “who is the user?” but “is this the correct server?” This two-way trust is what makes PKI the foundation of zero-trust network architectures.

Key advantages of PKI encryption over password-based authentication include:

• Certificates cannot be phished: There is no credential to steal from a user.
• Revocation is immediate: A compromised certificate can be invalidated centrally without requiring a password reset campaign.
• Identity is tied to the device and user together: It’s not just a password string anyone could know.
• PKI scales across thousands of devices, users, and services: It doesn’t create operational overhead per-credential.

How Public Key Encryption Works

If a public key encrypts the message, only the private key will be able to decrypt and access the message and vice versa.

The best analogy for public key encryption is the Bob-Alice trunk example, introduced by Panayotis Vryonis:

Two people, Bob and Alice, use a trunk to exchange messages. The trunk has a lock that only Bob and Alice can access. If Bob and Alice use the same key to lock and unlock the trunk, that explains symmetric encryption. There are just two states of the trunk, locked and unlocked.

However, asymmetric encryption incorporates a third state. The trunk may be:

• Locked on the left
• Unlocked in the middle
• Locked on the right

The process requires the use of two keys (public/private key pair). One key can only turn to the left side, while the other key can only turn to the right side. Both keys can lock the trunk, but whatever key you used to lock the trunk, only the other key can unlock it.

Alice can now pick one of the keys to be shared on the network, making it the “public” key and keeping the other one to herself, “private”. Bob can place a message inside the trunk and lock it with Alice’s public key (turning it all the way to the left), confident that only Alice can unlock the trunk and read the message.

Also, Alice can send a message back to Bob by locking it with her private key (turning it all the way to the right). Bob can verify Alice’s identity because only her private key has the ability to lock the trunk on the right side, guaranteeing that the message is from her.

Switch out the trunk with plaintext data and the physical keys with cryptographic keys and that’s the basics of public key cryptography.

In a digital space, one can write out a message in plaintext, or unencrypted data, and combine with a key to create a ciphertext, or encrypted data, which looks like a long string of random letters and numbers, confusing to the naked eye. The other key in the key pair can take this random string of data and turn it back into plaintext, allowing the user to read the message unencrypted.

• Plaintext + key = ciphertext
• Ciphertext + other key = plaintext

Public Key Cryptography and Digital Signatures

The digital signature allows recipients of messages to verify that the message is legit and the sender is who they say they are.

The sender signs the message with their private key, creating the digital signature. Here’s a quick overview of how it can be done:

1. Use a hash algorithm, more specifically a one-way hash function, to turn your message into a hash, a condensed version of the message.
2. Encrypt the hash with your private key, or sign the message, so the recipient can decrypt with your public key.
3. The hash can be combined with a user’s public key to create a digital signature. Now, if someone receives a message from them, the recipient can ensure the message is legit.
4. Once the recipient verifies your identity, they can decrypt the message with your public key and access the message.

Is Public Key Encryption Secure?

While private key (symmetric) encryption can be accomplished more quickly, public key encryption is more secure because it incorporates two keys instead of one.

If the shared private key in a symmetric system is lost or forgotten, users will not be able to encrypt or decrypt messages. If it is stolen, the entire system is compromised.

Asymmetric encryption is designed to be complex, strengthening security measures. Messages encrypted with a public key can only be decrypted with the corresponding private key, which is only accessible to the owner.

Digital certificates also increase security because they themselves are encrypted, meaning if they were to fall into the wrong hands, the certificate is still impenetrable.

Public key encryption gives responsibility to the user on how to manage the private key, because compromising the private key could lead to the data leak, user impersonation, or misusing of the digital certificates.

How SSL/TLS Uses Public Key Encryption

Public key cryptography is vital for Secure Sockets Layer (SSL) and Transport Layer Security (TLS), which are themselves vital for secure HTTPS web browsing. Websites have SSL/TLS certificates containing the public key, while the private key is installed on the website’s origin server, or CA.

SSL certificates are a vital part of the TLS “handshake”. When a browser initiates the handshake with a web server, the server sends its SSL certificate so the browser can verify the server’s identity by checking the CA that issued the certificate.

Digital certificates authenticate using the EAP-TLS authentication protocol, which is the most secure option when compared to other authentication protocols. EAP-TLS uses the TLS public key authentication mechanism in EAP, meaning both client and server can verify each other before starting the authentication process.

PKI Encryption for 802.1X and Wi-Fi Authentication

One of the most impactful applications of PKI encryption is 802.1X network authentication. 802.1X is the IEEE standard that controls access to wired and wireless networks. When combined with PKI, it replaces password-based Wi-Fi credentials with device and user certificates.

In an 802.1X PKI environment, a device presents its certificate to a RADIUS server during the authentication handshake. The RADIUS server validates the certificate against the organization’s CA — no password is ever transmitted. This eliminates credential phishing, credential sharing, and the risk of a leaked Wi-Fi password granting network access.

Cloud RADIUS from SecureW2 is purpose-built for certificate-based 802.1X authentication. It integrates directly with your PKI and identity providers to enforce policy at the point of network access — so every device connecting to your Wi-Fi or wired network has been cryptographically verified.

How to Generate a Public/Private Key Pair

Each public-key cryptosystem includes an algorithm to generate the keys. The algorithm on which the cryptosystem is supported provides a process to generate the public and private key pair.

There are several algorithms you can use to generate a public/private key pair, but we will discuss three main cryptosystems.

The RSA Algorithm

The Rivest-Shamir-Adleman algorithm is one of the original public key cryptosystems and still the most widely used public key cryptography algorithm. RSA is widely used because of its ability to distribute public keys and provide digital signatures. RSA is well-known for its strong security because it factors large integers that are nearly impossible to guess.

Theoretically, an attacker would have to try to factorize the large integer to find the private key and guess the random elements added in the key generation.

The DSA Algorithm

The Digital Signature Algorithm does exactly what it’s named after, creating digital signatures. DSA was proposed in 1991 by the National Institute of Standards and Technology and is the standard for government agencies, while RSA is used more in the private sector.

DSA was introduced after RSA and may seem like a downgrade because it can only do digital signatures and not public key encryption. However, both methods are very similar and both are lauded in regards to security. The differences lie in the arithmetic used and speed. DSA is a much faster signature, but RSA is better at verification. In the end, both RSA and DSA are pretty equal in terms of compatibility since they both use the same IPs and digital certificates.

Elliptic Curve Cryptosystem

Cryptographers quickly noticed the more complex the mathematics behind a cryptosystem, the more secure it is.

The Elliptic Curve is a mathematical structure that has been in the theoretical field of mathematics for many years. On it, we can also define the Discrete Logarithm Problem, but with numbers living in a curve. So the curve is part of the public key and some random number on the curve is the private key.

PKI Encryption Security: Protecting Private Keys

So far, we’ve covered how important private keys are in public key encryption. Public keys don’t need to be stored anywhere since they’re available to the public, but private keys need to stay protected in order for the whole process to work.

With SecureW2, admins can use our purpose-built technology that prevents private keys from being exported from devices.  This extra PKI security layer ensures certificates are never stolen or transferred from the device.

Certificates need to be tied to devices, but the best private key protection requires an HSM. The SecureW2 PKI backs all private keys in an HSM, a crypto processing device that delivers strong encryption and security benefits.  HSMs are designed to protect and manage all private keys in the network. On the key management side, the HSM oversees the complete lifecycle of private keys, including creation, rotation, deletion, auditing, and API integration support.

How to Recover a Private Key

There are several reasons for a private key to be missing, but the most common ways are either the certificate wasn’t installed on the server that generated the CSR, the certificate was installed incorrectly, or the request was outright deleted.

Private key recovery usually depends on the operating system your environment uses.

Many organizations will use a key escrow to protect and easily recover cryptographic keys in case of an emergency, like a security breach or natural disaster. The private keys are stored in a trusted third party and the organization can set guidelines for the escrow service provider on who is allowed access to the keys.

Key escrows differ from a key recovery agent, which is a person authorized to recover a certificate for an end user. The recovery agent is usually a high-ranking member of the IT department and is permitted to decrypt a user’s encrypted data during an emergency. A key escrow is someone who holds the key for end users, while a recovery agent has the master key.

On-Premise PKI vs. Managed PKI Encryption

Public key encryption strengthens wireless security because of its asymmetric key pairing. Sharing one private key that both encrypts and decrypts gets the job done more quickly, but is a massive security risk. The public/private key pairing ensures that only the right person will see the message and proves the identity of the key owner.

Running PKI on-premises gives an organization full control over its certificate infrastructure, but that control comes at a cost: dedicated hardware, specialized staff, manual certificate lifecycle management, and a substantial upfront investment. For most organizations, the maintenance burden outweighs the benefit of self-hosting.

Managed PKI moves that infrastructure to the cloud. A managed PKI provider handles CA management, certificate issuance, renewal, and revocation — with policy automation that eliminates manual overhead. SecureW2’s Dynamic PKI integrates with existing identity providers and MDM platforms, so organizations can issue and manage certificates at scale without dedicated PKI engineers on staff.

If you are ready to move your organization to certificate-based authentication, schedule a demo with SecureW2 to see how the SecureW2 Managed PKI can be deployed in your environment — no forklift upgrade required.

---

Frequently Asked Questions

What is PKI encryption?

PKI encryption is a system that uses a pair of cryptographic keys — one public, one private — to secure communications, authenticate identities, and sign data. The public key is shared openly; the private key is kept secret by the owner. Data encrypted with the public key can only be decrypted by the corresponding private key, ensuring only the intended recipient can read the message.

What is the difference between symmetric and asymmetric PKI encryption?

Symmetric encryption uses a single shared key for both encryption and decryption — fast, but vulnerable if the key is intercepted. Asymmetric encryption (the basis of PKI) uses a key pair: one key encrypts, the other decrypts. This eliminates the need to share a secret key, making it far more secure for open-channel communication and identity verification.

What is PKI used for?

PKI is used wherever digital identity and secure communication are required: HTTPS web security, email encryption and signing, VPN authentication, 802.1X Wi-Fi access control, code signing, and document signing. Any system that needs to verify “this message came from who it claims to” or “this connection is going where it claims to” relies on PKI.

How does PKI encryption work for Wi-Fi authentication?

In a Wi-Fi environment using 802.1X authentication, a device presents a PKI certificate to a RADIUS server instead of a username and password. The RADIUS server validates the certificate against the organization’s Certificate Authority. If the certificate is valid and matches policy, the device is granted network access — with no password exchanged at any point.

What is managed PKI encryption?

Managed PKI is a cloud-hosted certificate infrastructure service where a provider handles CA management, certificate issuance, renewal, and revocation on behalf of the organization. Rather than building and maintaining on-premise PKI hardware and software, organizations subscribe to a managed service that delivers the same cryptographic security with far less operational overhead. SecureW2 offers managed PKI that integrates with major identity providers, MDM platforms, and network access controls.