Public-key encryption is an encryption method in which the intended recipient has a publicly distributable encryption key and a corresponding private decryption key. A sender can obtain the recipient's public key and use it to encrypt information, while the corresponding private key is required to decrypt it. The fundamental benefit is that the sender does not need to receive a secret encryption key from the recipient beforehand. Public-key encryption is therefore a specific application of asymmetric cryptography focused on confidentiality, although the broader field of public-key cryptography also includes signatures and key-agreement mechanisms.
A simplified example involves Alice and Bob. Bob generates a public-private key pair and publishes the public key while protecting the private key. Alice obtains Bob's authentic public key and uses it with an appropriate public-key encryption scheme to encrypt a message. The resulting ciphertext can be transmitted through an untrusted network. Bob uses his private key to decrypt the ciphertext. An attacker observing the public key and ciphertext should not be able to feasibly recover the plaintext without Bob's private key, assuming the cryptographic scheme and implementation are secure.
The term public-key encryption can be confused with digital signatures because both use public and private keys. The purpose is different. Public-key encryption primarily protects confidentiality for a designated recipient: the recipient's public key is used for encryption and the corresponding private key is used for decryption. A digital signature primarily provides authenticity and integrity: the signer uses a private key to create the signature and other parties use the corresponding public key to verify it. The informal phrase that someone encrypts with a private key and decrypts with a public key is therefore generally an inaccurate description of digital signatures rather than a recommended explanation of public-key encryption.
RSA is a historically important public-key encryption algorithm, but secure RSA encryption requires a defined padding and encoding scheme. RSA-OAEP is a standardised construction designed for secure probabilistic encryption, whereas raw textbook RSA is insecure because deterministic mathematical transformations can reveal structural information and permit attacks. Modern public-key encryption systems generally incorporate randomness so that encrypting the same plaintext multiple times does not produce the same ciphertext. This probabilistic property is important because deterministic encryption would allow attackers to recognise repeated plaintexts or test likely messages under certain conditions.
Public-key encryption is usually not used to encrypt large files or long network sessions directly because public-key operations are substantially more expensive than symmetric operations. Instead, a common design is hybrid encryption. The sender generates a random symmetric session key, encrypts the large plaintext efficiently with a symmetric authenticated-encryption algorithm, and then uses the recipient's public-key mechanism to protect the session key. The recipient uses the private key to recover the session key and then decrypts the bulk ciphertext symmetrically. This architecture combines public-key key distribution with symmetric performance.
Authenticity of the public key is essential. If Alice retrieves a key that an attacker falsely claims belongs to Bob, Alice could encrypt the message for the attacker instead. Public-key infrastructures can associate public keys with identities through digital certificates signed by certificate authorities. Applications may also use alternative trust models, such as explicit key fingerprints, web-of-trust approaches or pinned keys. The security property provided by the encryption algorithm therefore depends partly on obtaining the correct public key. Encryption with a cryptographically valid but attacker-controlled public key does not provide confidentiality against that attacker.
Public-key encryption does not by itself prove who sent a ciphertext or that its contents were not manipulated in every possible protocol. Confidentiality, integrity, authentication and non-repudiation are distinct security objectives that may require different mechanisms. Authenticated public-key encryption schemes or hybrid protocols can provide integrity protections, while digital signatures can provide sender authentication and evidence associated with a private key. Secure applications must select cryptographic primitives according to the precise security goals rather than assuming that any operation involving public and private keys automatically provides every security property.
Public-key encryption was a major development in cryptography because it allowed secure communication without requiring the communicating parties to share a secret encryption key in advance. Its practical role today is often narrower than the broader concept of public-key cryptography: encryption protects confidentiality, signatures authenticate and protect integrity, and key-agreement protocols establish shared secrets. Modern systems also need to account for evolving algorithm standards, implementation vulnerabilities and the eventual impact of quantum computing on traditional public-key algorithms.
