Asymmetric encryption and decryption require two keys: a public key and a private key. In cryptography, these two keys form a pair and possess a bidirectional property. This means either the public key or the private key can be used for encryption, but decryption can only be performed by the other key. The public key can be given to anyone, even if they are untrusted, while the private key must be kept secret by its owner.
Compared to symmetric encryption, asymmetric encryption does not require a reliable channel for key distribution. It is typically applied between systems with unequal trust levels to enable the encrypted transmission of sensitive data or the verification of digital signatures.
Types of Asymmetric Keys
Currently, Tencent Cloud KMS supports the following three asymmetric key algorithm types:
RSA
Currently, KMS supports RSA keys with a modulus length of 2048 bits, where KeyUsage = ASYMMETRIC_DECRYPT_RSA_2048.
SM2
SM2 is a public-key cryptographic algorithm defined by the Chinese national cryptographic standards. It is used to replace the RSA algorithm within China's commercial cryptography system. For applications that have corresponding national cryptographic requirements, you can consider using this type of key, where KeyUsage = ASYMMETRIC_DECRYPT_SM2.
ECC
ECC is an encryption algorithm based on elliptic curves, where KeyUsage = ASYMMETRIC_SIGN_VERIFY_ECC.
Typical Scenarios for Asymmetric Encryption
In practical applications, asymmetric encryption and decryption encompass two typical scenarios: encrypted communication and digital signature.
Encrypted Communication
Encrypted communication is a typical application of asymmetric encryption algorithms. The process of encrypted communication is similar to symmetric encryption, with the key difference being that it requires the use of a public key for encryption and a private key for decryption.
The principle of the encrypted communication scenario is explained as follows:
1. The information recipient creates a public-private key pair and provides the public key to one or more information senders.
2. The information sender encrypts the sensitive information using the public key and then transmits the resulting ciphertext to the information recipient via a transmission medium.
3. After obtaining the data from the transmission medium, the information recipient decrypts the information using the private key they hold, thereby restoring the original text.
Since ciphertext can only be decrypted with the private key, and the private key is not publicly disclosed, even if information is leaked due to the low security of the transmission medium, the person who obtains the ciphertext cannot decipher it, thereby ensuring the security of the sensitive information.
Digital Signature
Digital signature technology is another typical application of asymmetric encryption algorithms. A digital signature consists of two processes: signing and verification. The private key is used for signing, while the public key is used for verification. This implementation process is the opposite of encrypted communication.
The principle of the digital signature scenario is explained as follows:
1. The information sender creates a public-private key pair and provides the public key to one or more information recipients.
2. The information sender generates a message digest from the original text using a hash function, and then encrypts this digest with a private key, thereby obtaining the digital signature corresponding to the original message.
3. The information sender transmits the original message and the digital signature together to the information recipient.
4. After obtaining the original message and the digital signature, the information recipient generates digest A from the original message using the same hash function. Additionally, they decrypt the digital signature with the public key provided by the sender to obtain digest B. By comparing whether A and B are identical, they verify whether the original text has been tampered with.
Since a signature is generated by encrypting with a private key, and the private key is not publicly disclosed, this gives the signature a unique characteristic. Therefore, a digital signature can both ensure that data is not tampered with during transmission and guarantee the authenticity of the information sender's identity, thereby preventing repudiation in transactions.
Attention:
Due to the specific use cases of public-private key pairs, KMS does not support automatic rotation for asymmetric CMKs. If you need to update the keys you use on a regular or ad-hoc basis, you can create new asymmetric keys yourself.