Public-key cryptography: A family of cryptographic methods that use a pair of linked keys, a public key that can be shared and a private key kept secret, to encrypt, exchange secrets and create or verify digital signatures.
Also known as: Asymmetric cryptography, Public-key encryption, PKC
Key takeaways
- Each party has a key pair: the public key can be shared, the private key must stay secret.
- It solves the problem of agreeing on a secret over an untrusted network.
- It also powers digital signatures and the certificates that prove a website's identity.
- In practice it is combined with fast symmetric ciphers like AES for the bulk of the data.
- C Chat relies on it through TLS; stored messages are protected with AES-256 and per-organization keys.
For most of history, secret communication had a chicken-and-egg problem: to talk securely, you first had to share a secret key securely. Public-key cryptography, developed in the 1970s, broke that loop. It is now built into almost everything you do online, from opening a bank website to receiving a software update.
Public-key cryptography: a plain definition
Each participant generates a key pair. The two keys are mathematically related but you cannot derive the private key from the public one in any practical time.
| Use | Which key does what |
|---|---|
| Encryption | Anyone encrypts with your public key; only your private key decrypts |
| Digital signature | You sign with your private key; anyone verifies with your public key |
| Key agreement | Two parties combine their key pairs to compute a shared secret no eavesdropper can calculate |
A useful mental model: the public key is an open padlock you hand out freely; the private key is the only key that opens it.
How it works
Public-key operations are much slower than symmetric ones, so real systems use a hybrid approach:
- Authenticate. A server proves its identity with a certificate, a public key signed by a trusted authority.
- Agree on a secret. The two sides use key agreement (commonly elliptic-curve Diffie-Hellman) to derive a fresh shared secret.
- Switch to symmetric encryption. That secret becomes a session key for a fast cipher such as AES-256.
- Discard session keys. Using fresh keys for each session supports forward secrecy-style protection.
This is exactly what TLS does at the start of every secure connection. The same building blocks, applied between users’ devices instead of device and server, form the basis of end-to-end encryption.
Why it matters for business messaging
Public-key cryptography answers two questions every messaging system faces:
- Am I talking to the real service? Certificates let your phone confirm it reached the genuine server, not an impostor on the network.
- Can we set up a private channel? Key agreement protects every connection, even on public Wi-Fi.
Where the private keys live defines the encryption model. If they sit only on users’ devices and are used for message content, the provider cannot read messages. If they secure the connection to the server, the server can process content and apply organizational rules. That distinction is at the heart of auditable encryption vs end-to-end encryption.
How it relates to C Chat
C Chat uses public-key cryptography as part of TLS for every connection between its apps, its web app and its servers. See TLS in C Chat: how messages travel protected.
For stored data, C Chat uses symmetric encryption: messages are encrypted at rest with AES-256 using a key per organization, managed by the service. That design is covered in per-organization keys explained, per-organization encryption keys and AES-256 encryption at rest, per organization.
Because C Chat does not use per-user key pairs for end-to-end encryption, it can offer auditable encryption: team owners and admins can audit and export group conversations, direct messages between people stay private, and platform access for moderation of reported messages or legal requirements is logged. The full picture is in how C Chat encrypts your messages.
Related terms and common misconceptions
- “Public key means anyone can read my data.” The public key only locks or verifies; reading needs the private key.
- “Asymmetric encryption is used for everything.” It is usually reserved for setup and signatures; symmetric ciphers handle the data.
- “Quantum computers have already broken it.” Not today. Standards bodies are preparing post-quantum algorithms as a precaution. Ask vendors about their plans as part of key management reviews and the vendor security questionnaire.
Getting started
You benefit from public-key cryptography in C Chat without configuring anything: every connection is protected by TLS. Open the web app at getcchat.com/c, sign up with your phone number or email and create your first team.
Frequently asked questions
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption, such as AES, uses one shared secret key for encrypting and decrypting. Asymmetric encryption uses a key pair: what one key locks, only the other can unlock. Asymmetric methods are slower, so systems use them to set up keys and then switch to symmetric encryption.
What are examples of public-key algorithms?
Common ones include RSA, elliptic-curve methods such as ECDH for key agreement and ECDSA or Ed25519 for signatures. They are used in TLS, secure email, software signing and messaging apps that use end-to-end encryption.
Can I share my public key safely?
Yes, that is its purpose. The public key lets others encrypt data for you or verify your signatures. The private key must never be shared, and the security of the system depends on keeping it secret.
Does C Chat use public-key cryptography for messages?
C Chat uses public-key cryptography within TLS to secure connections. It does not use per-user key pairs for end-to-end encryption; stored messages are encrypted with AES-256 using a key per organization, which enables auditable group conversations.