Asymmetric Encryption and TLS

Symmetric encryption left a puzzle: how do Tiffin's server and a customer's phone, strangers who have never met, agree on a shared secret key while anyone could be listening? Asymmetric cryptography solves it, and it also lets the pipeline prove that an image really came from Tiffin.

The rule

Public locks and checks; private unlocks and signs.

Each party has a key pair made together:

• the public key, which can be given to anyone
• the private key, which never leaves its owner

What one key does, only the other can undo. That gives two uses:

• Encryption: anyone encrypts with Tiffin's public key; only Tiffin's private key decrypts.
• Signatures: Tiffin signs with its private key; anyone checks the signature with the public key. A valid signature proves who signed and that nothing changed since.

Common algorithms are RSA and elliptic-curve schemes such as ECDSA and Ed25519. Asymmetric operations are much slower than symmetric ones, so real systems use them briefly and then hand over to a symmetric key.

TLS, the protocol behind https://, is the best-known combination:

1. The server sends its certificate: its public key plus a statement, signed by a certificate authority (CA), that the key belongs to tiffin.example.
2. The browser checks that signature against CAs it already trusts, and checks the name matches.
3. Both sides agree on a fresh session key using a key exchange, and the server proves it holds the certificate's private key.
4. Everything after that is encrypted with the fast symmetric session key.

The shortcut

Say the rule and ask "Who must be able to do this?" Only the owner → private key. Everyone → public key.

Drills

Answer fast — trust the rule.

Remember

• Public locks and checks; private unlocks and signs.
• Ask "who must be able to do this?" Only the owner → private key.
• TLS: certificate and key exchange first, fast symmetric encryption after.