A digital signature depends on a key pair. The private key makes the signature. The public key lets anyone check it. They are generated together, and what one does the other can undo.

Knowing the public key does not let anyone work out the private one. That one-way relationship is the basis of asymmetric cryptography.

Key pair meaning

Think of a letterbox with a slot. Anyone can post a letter in (the public key), but only the holder of the key can open it (the private key). For signatures the direction is reversed: only the holder can make the mark, and anyone can check it.

How a key pair is generated

Software picks an algorithm and a size, then uses a random number generator to produce the pair. RSA and ECDSA are the two common algorithms. Good randomness matters: a predictable generator produces keys an attacker can guess. Generating the pair inside a secure element, USB token or HSM means the private key is created there and never leaves.

Key pair vs certificate

A key pair on its own says nothing about who holds it. A certificate adds the identity: the authority signs a statement that this public key belongs to this person. The key pair is the lock and key. The certificate is the label on the door.

Looking after the private key

Anyone who has the private key can sign as its owner, so it is the item to protect. Options, from weakest to strongest, are a password-protected file, a USB token, and keys in a phone’s secure hardware or an HSM that cannot be exported. If a private key is lost or exposed, ask for revocation and get a new pair. A key pair is not meant to be reused for ever: certificates expire and keys are replaced with them.

Example: creating a key pair for a certificate request

In the ePahichan app, setting up a certificate starts with the phone creating a key pair in its secure hardware. The app sends the authority the public key as part of a certificate request, with identity evidence. The private key stays in the phone.

When the certificate arrives, it names the person and holds the public key. Signing later uses the private key in the hardware, and anyone checking uses the public key in the certificate. At no point does the private key travel.

How long a key pair should be used

A key pair should live no longer than its certificate. When the certificate is renewed, a new pair is created, so an exposure in the past cannot continue to threaten future signatures. Keys used for signing should not also be used for encryption, because the policies for backing them up are opposite: a signing key should exist in one place only, while an encryption key often needs a backup so data can be recovered.

If a business needs to sign on behalf of many people, each person should hold their own pair, tied to their own certificate. Sharing one pair across staff removes the point of a signature, which is to show who signed.

Key pair vs password

A password is a shared secret: you and the system both know it, and the system stores a copy or a fingerprint of it. A key pair is different. The system holds only the public key, which is of no use to an attacker, and the private key is never sent anywhere. That is why signing with a key pair is stronger than typing a password: a breach of the system’s database does not reveal anything that lets someone sign as you.

The private key can be protected with a PIN, a fingerprint or a face scan, which unlock it locally. Those are local checks to use the key and are not the key itself.

Questions people ask about key pairs

What is a key pair in cryptography?

A matched private key and public key created together. The private key is kept secret and the public key is shared.

Can the public key be used to find the private key?

Not in practice. With strong algorithms and sizes, the work needed is far beyond what any computer can do.

How many key pairs do I need?

One for each certificate or purpose. Keeping signing keys separate from encryption keys limits the damage if one is lost.

Where is my key pair stored in ePahichan?

The signing key is created in the phone’s secure hardware and unlocked with fingerprint or face.