Public-key cryptography

Public-key cryptography
Name	Public-key cryptography
Invented	1970s
Inventors	Whitfield Diffie; Martin Hellman; Ralph Merkle; Ronald Rivest; Adi Shamir; Leonard Adleman
Related	Cryptography; Number theory; Information security; Computer science

Public-key cryptography Public-key cryptography transformed secure communication by introducing asymmetric key pairs enabling confidentiality, authentication, and non-repudiation. Developed amid advances in Massachusetts Institute of Technology research and Cold War era concerns, it rapidly influenced institutions such as National Security Agency, IBM, and Bell Labs and reshaped protocols used by Internet Engineering Task Force, World Wide Web Consortium, and commercial entities like Microsoft and Google. Its adoption spans standards promulgated by National Institute of Standards and Technology, legal frameworks including United States Electronic Communications Privacy Act, and industries led by Visa, Mastercard, and SWIFT.

History

Early work traces to public research by figures at Stanford University and Harvard University; precursors include private key ideas discussed at RAND Corporation and correspondence involving Claude Shannon, Alan Turing, and Gordon Welchman. The modern breakthrough appeared in the 1970s with the mortuary of ideas coalescing around contributions from Whitfield Diffie, Martin Hellman, and Ralph Merkle, and the publicization of the Diffie–Hellman key exchange concept influenced by efforts at Stanford Research Institute and reactions from National Security Agency. The independent invention of asymmetric algorithms by Ronald Rivest, Adi Shamir, and Leonard Adleman produced RSA (cryptosystem), which rapidly garnered attention from MIT Press, IEEE, and cryptographers at University of California, Berkeley. Subsequent milestones include the development of Elliptic-curve cryptography by researchers at Certicom and academic groups at Koblitz and Miller, standards work at International Telecommunication Union, and the policy debates chronicled at United States Congress hearings and actions by European Parliament.

Mathematical Foundations

Foundations rest on number theory and algebraic structures explored by researchers from Princeton University, University of Cambridge, and École Polytechnique. Prime factorization hardness underpins RSA (cryptosystem), drawing on work by Carl Friedrich Gauss, Pierre de Fermat, and modern algorithmic advances by Peter Shor and Manindra Agrawal. Discrete logarithm problems support Diffie–Hellman key exchange and protocols inspired by contributions from Évariste Galois-era group theory and lattice problems studied at Courant Institute. Elliptic-curve frameworks trace to Niels Henrik Abel and André Weil, with security analyses by mathematicians at University of Washington and University of Michigan. Complexity theory concepts from Alan Turing, Stephen Cook, and Richard Karp frame hardness assumptions, while probabilistic number theory and randomness extraction owe to work at Bell Labs and Los Alamos National Laboratory.

Key Algorithms and Protocols

Core algorithms include RSA (cryptosystem), Diffie–Hellman key exchange, ElGamal encryption, and Elliptic-curve cryptography, each standardized in specifications by Internet Engineering Task Force and implemented by vendors such as OpenSSL Project, Mozilla Foundation, and Microsoft Corporation. Signature schemes range from Digital Signature Algorithm to ECDSA and contemporary constructs like EdDSA, influenced by research from University of Waterloo and University of California, Davis. Protocols for secure channels include Secure Sockets Layer, the successor Transport Layer Security, and application-layer mechanisms in S/MIME, PGP, and OAuth developed with input from IETF working groups and corporations including Netscape, Cisco Systems, and Amazon Web Services. Key management and distribution patterns derive from schemes like Pretty Good Privacy and infrastructure models exemplified by X.509 and certificate authorities such as VeriSign and Entrust.

Applications and Uses

Public-key cryptography underpins secure web browsing on sites like Amazon.com, eBay, and Bank of America, securing transactions by payment networks including Visa and Mastercard. It enables secure email through PGP adoption in communities linked to Electronic Frontier Foundation advocacy and enterprise systems at IBM and Oracle Corporation. Digital signatures authenticate software distributed by Red Hat and Canonical (software company) and validate documents accepted by courts in jurisdictions influenced by European Court of Justice decisions. Authentication and identity frameworks in federated services involve Kerberos integrations at MIT and single sign-on systems used by Facebook and Google. Critical infrastructure such as Nuclear Regulatory Commission-related control networks and aerospace systems at Boeing rely on asymmetric cryptography for firmware verification.

Security and Attacks

Security assessments have evolved through incidents involving actors like Anonymous (group), techniques exposed by researchers at Carnegie Mellon University, and advisories from US-CERT. Attacks exploit mathematical advances exemplified by Peter Shor’s quantum algorithm, prompting attention from Google Quantum AI, IBM Quantum, and research labs at D-Wave Systems. Side-channel attacks were demonstrated by teams at University of Cambridge and KU Leuven, while implementation flaws surfaced in projects like OpenSSL Project (notably the Heartbleed bug) and vendor advisories from Microsoft Security Response Center. Cryptanalysis efforts by institutions such as National Institute of Standards and Technology and GCHQ continue to test assumptions, and policy responses have involved balancing export controls from United States Department of Commerce and legal evidence frameworks at Supreme Court of the United States.

Implementation and Standards

Standards bodies including National Institute of Standards and Technology, International Organization for Standardization, Internet Engineering Task Force, and International Telecommunication Union publish specifications adopted by implementers like OpenSSL Project, LibreSSL, Bouncy Castle, and commercial vendors Microsoft, Apple Inc., and Red Hat. Post-quantum efforts led by consortia at NIST Post-Quantum Cryptography Standardization and collaborations with European Union Agency for Cybersecurity seek replacements influenced by proposals from CRYSTALS-Kyber, NTRU, and lattice researchers at Technische Universität Darmstadt. Compliance and certification regimes involve FIPS 140-2, procurement lists from Department of Defense (United States), and cybersecurity frameworks published by National Institute of Standards and Technology. The ecosystem includes certificate authorities like Let’s Encrypt, revocation systems endorsed by Internet Engineering Task Force, and PKI deployments in sectors overseen by Federal Aviation Administration and Health and Human Services (United States).

Category:Cryptography