How do public and private keys work together?

PKI relies entirely on asymmetric cryptography, a system in which every identity is assigned a mathematically related pair of keys rather than a single shared secret. The public key can be distributed freely, typically embedded inside a digital certificate, while the private key must remain confidential to its owner at all times. What one key encrypts, only the other can decrypt, and this reversible relationship is what makes secure communication between strangers possible without ever exchanging a shared password.

How the key pair is used in practice:

• Encryption: Data encrypted with a recipient's public key can only be decrypted with their private key, keeping the content confidential in transit.
• Digital signatures: Data signed with an owner's private key can be verified by anyone using the corresponding public key, proving authenticity and integrity.
• Certificate binding: A Certificate Authority signs a certificate that ties a specific public key to a verified identity, so the key pair's owner can be trusted.
• Key protection: Because the private key is the single point of trust, it is typically generated and stored in a hardware security module (HSM) for CA and high-value identities.

This asymmetric model is what allows two parties who have never met to establish encrypted, authenticated communication, which is the basis for everything from HTTPS browsing to signed software updates.