Public Key vs Private Key in RSA
Understand the difference between RSA public and private keys, their roles in encryption and signing, and why keeping your private key secure is critical.
Detailed Explanation
Public Key vs Private Key in RSA
In RSA cryptography, a key pair consists of two mathematically linked keys that serve complementary purposes. Understanding the distinction between them is fundamental to using RSA correctly.
The Public Key
The public key is designed to be shared openly. It consists of the modulus n and the public exponent e. Its roles include:
- Encrypting data — anyone can encrypt a message that only the private key holder can read
- Verifying signatures — anyone can confirm that a message was signed by the corresponding private key
Public Key (PEM header):
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...
-----END PUBLIC KEY-----
The Private Key
The private key must be kept secret at all times. It contains the modulus n, the private exponent d, and additional components for efficient computation (the CRT parameters p, q, dp, dq, qinv). Its roles include:
- Decrypting data — only the private key can decrypt messages encrypted with the corresponding public key
- Creating signatures — digitally signing data to prove authenticity
Private Key (PEM header):
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASC...
-----END PRIVATE KEY-----
Key Relationship
The mathematical relationship ensures that:
- Data encrypted with the public key can only be decrypted with the matching private key
- A signature created with the private key can only be verified with the matching public key
- Deriving the private key from the public key is computationally infeasible
Common Mistakes
- Committing private keys to Git — use
.gitignoreand secrets management - Sharing private keys between services — each service should have its own key pair
- Using the same key pair for encryption and signing — use separate pairs for each purpose
- Not setting file permissions — private keys should be
chmod 600(owner read/write only)
Use Case
Every developer working with SSH, TLS/SSL, JWT tokens, or encrypted APIs must understand the public/private key distinction. Misconfiguring key usage — such as accidentally exposing a private key or using keys for the wrong purpose — can lead to critical security vulnerabilities.