AQA 7517 · Paper 2 · 4.5.6b

RSA & Asymmetric
Encryption

Public-key cryptography · Key pairs · Secure key exchange

WHAT YOU'LL LEARN

Symmetric vs asymmetric · Public/private keys · RSA principle · Key exchange · HTTPS

AQA SPEC LINK

4.5.6 — Asymmetric encryption, public/private keys, RSA

The Key Problem

Problem with Symmetric Encryption

In symmetric encryption (like Vernam), both parties must share the same secret key. How do you securely share that key in the first place — especially over the internet?

If you send the key unencrypted, an attacker can intercept it

You can't encrypt the key with itself — chicken-and-egg problem

Solution: asymmetric (public-key) cryptography

Asymmetric Encryption

Public & Private Key Pairs

Each party has a key pair: a public key (shared with everyone) and a private key (kept secret)

Encrypt with public key → only the private key can decrypt

Encrypt with private key → only the public key can decrypt (used in digital signatures)

The keys are mathematically linked but computationally infeasible to derive one from the other

RSA Algorithm

RSA — Rivest, Shamir, Adleman (1977)

RSA security relies on the difficulty of factoring large numbers that are the product of two large primes.

Choose two large primes: p and q. Compute n = p × q (n can be 2048+ bits)

Public key contains n and an exponent e (published)

Private key contains n and a private exponent d (kept secret)

Factoring n back into p × q is computationally infeasible for large n

Encryption Flow

How Asymmetric Encryption Works

1. Alice generates a public/private key pair. Publishes her public key.

2. Bob wants to send Alice a secret message. Bob encrypts with Alice's public key.

3. Ciphertext sent over the internet — anyone can intercept it but cannot decrypt it.

4. Alice decrypts using her private key — only she can do this.

The private key never leaves Alice's device — no key exchange problem!

Symmetric vs Asymmetric

Comparison

Feature	Symmetric	Asymmetric
Keys	Same key both ends	Public + private pair
Speed	Fast	Slower
Key sharing	Insecure (must pre-share)	Public key freely shared
Use	Large data (AES)	Key exchange, signatures

Hybrid Encryption

Real-World: Combining Both

HTTPS uses both: asymmetric RSA to securely exchange a symmetric session key, then fast symmetric encryption (AES) for the actual data.

1. Browser gets server's public key (in certificate)

2. Browser generates a random symmetric session key

3. Session key encrypted with server's RSA public key → sent to server

4. Server decrypts session key with private key. Now both use fast AES.

Where RSA is Used

Real-World Applications

HTTPS/TLS — securing web browsing; the padlock in your browser

SSH — secure remote login to servers

Email encryption — PGP/GPG for encrypted email

Digital signatures — signing software, documents, cryptocurrency transactions

Typical key sizes: RSA-2048 or RSA-4096 (number of bits in n)

AQA Exam Style

Practice Question

AQA 7517 — Paper 2 Style

(a) Explain what is meant by a 'public key' and a 'private key' in asymmetric encryption. [2]
(b) Describe how Bob can send an encrypted message to Alice using asymmetric encryption. [3]
(c) RSA encryption relies on a mathematical problem. State what that problem is. [1]
(d) Explain why HTTPS uses both asymmetric and symmetric encryption rather than just one type. [2]

[8 marks]

2 marks

(a) Public key: shared openly, used to encrypt data [1]. Private key: kept secret by owner, used to decrypt data encrypted with the corresponding public key [1]

3 marks

(b) Bob obtains Alice's public key [1]. Bob encrypts message with Alice's public key [1]. Only Alice can decrypt using her private key [1]

1 mark

(c) Factoring the product of two very large prime numbers

2 marks

(d) Asymmetric used to securely exchange a session key [1]; symmetric (AES) then used for data because it is much faster / more efficient for large amounts of data [1]

Summary

Key Points to Remember

Asymmetric encryption — public key encrypts, private key decrypts; solves key distribution

RSA — security based on difficulty of factoring large primes; 2048+ bit keys

Hybrid encryption — asymmetric to exchange key, symmetric (AES) for speed

Private key never shared or transmitted — never leaves owner's device

Public key can be freely published without compromising security

🎉 Lesson complete — move to the quiz!