Cryptography and Digital Security

Two keys, mathematically linked, doing two different jobs

Modern digital security rests on asymmetric cryptography: each entity holds a pair of mathematically linked keys, a public key, which is freely shared with anyone, and a private key, which is kept absolutely secret. What one key encrypts, only the other can decrypt, and that one property is what makes both encryption and digital signatures possible from the same underlying mechanism, used in opposite directions.

To send someone a confidential message, you encrypt it using their public key. Because only their matching private key can decrypt it, only they can read it, even though the public key used to lock it is available to anyone.

To prove a message genuinely came from you and has not been altered, you do the reverse: you sign it using your own private key. Anyone holding your public key can then verify that signature, confirming both that it came from you specifically and that the content has not been tampered with since you signed it.

Public Key Infrastructure: the system that makes trust checkable by a stranger

A public key by itself proves nothing about who it actually belongs to; anyone could generate a key pair and claim any identity. Public Key Infrastructure (PKI) is the system built to solve exactly that problem, by creating a chain of verified trust.

A Certifying Authority (CA) issues a digital certificate, which binds a specific public key to a verified identity, the certificate holder, along with the CA's own identity, a validity period, and the CA's own digital signature vouching for all of it. A Registration Authority (RA) does the actual identity-checking legwork before a certificate is issued, verifying that the person or organisation requesting a certificate genuinely is who they claim to be, so that the CA is not vouching for an unverified claim.

In India, the Controller of Certifying Authorities (CCA), operating under the Information Technology Act, licenses Certifying Authorities and certifies their public keys using its own private key. This creates a single chain of trust rooted in the CCA: anyone can verify that a given certificate genuinely traces back to a licensed, government-recognised CA, rather than to an arbitrary unverified source.

Legal recognition: a digital signature is not a scanned signature

The Information Technology Act, 2000 gives digital signatures based on this asymmetric cryptographic system legal standing equal to a handwritten signature. This is worth stating precisely because it is routinely confused with an image of a handwritten signature pasted into a document, which carries none of the cryptographic guarantee a true digital signature provides, since an image can simply be copied onto a forged document with no detectable difference. A genuine digital signature is mathematically tied to both the specific signer's private key and the specific content signed, which is exactly why altering either invalidates it.

Quick revision points

• Asymmetric cryptography: a public key (shared freely) and a private key (kept secret), mathematically linked. Encrypting to someone uses their public key, decryptable only by their private key. Signing as someone uses your own private key, verifiable by anyone with your public key.
• PKI solves the problem that a public key alone proves nothing about identity. A Certifying Authority (CA) issues certificates binding a public key to a verified identity; a Registration Authority (RA) does the actual identity verification before a CA issues one.
• India's Controller of Certifying Authorities (CCA), under the IT Act, licenses CAs and certifies their keys, creating one government-rooted chain of trust.
• The IT Act, 2000 gives a genuine digital signature legal standing equal to a handwritten one. This is not the same as a scanned or pasted image of a signature, which carries no cryptographic guarantee and can be forged undetectably.