Posted on June 13, 2025June 13, 2025 | by priteshgeek

Introduction & Overview

What is Public Key Cryptography?

Public key cryptography, also known as asymmetric cryptography, uses a pair of mathematically related keys: a public key for encryption and a private key for decryption. Unlike symmetric cryptography, which relies on a single shared key, public key cryptography enables secure data exchange and authentication without sharing sensitive secrets. It is foundational to secure protocols like TLS/SSL, SSH, and digital signatures.

History or Background

Public key cryptography emerged as a revolutionary concept in the 1970s:

1976: Whitfield Diffie and Martin Hellman introduced the concept of public key cryptography, solving the key exchange problem.
1978: The RSA algorithm, developed by Ron Rivest, Adi Shamir, and Leonard Adleman, became a cornerstone implementation.
1991: Phil Zimmermann’s Pretty Good Privacy (PGP) popularized public key cryptography for secure email and file encryption.
Today, it underpins secure communication, authentication, and data integrity in modern systems.

Why is it Relevant in DevSecOps?

DevSecOps integrates security into every phase of the software development lifecycle (SDLC). Public key cryptography is critical for:

Secure Communication: Protects data in transit within CI/CD pipelines and cloud environments.
Authentication: Verifies identities of users, services, and systems.
Integrity: Ensures code, containers, and configurations are not tampered with using digital signatures.
Compliance: Aligns with regulations like GDPR, HIPAA, and PCI-DSS by securing sensitive data.

Core Concepts & Terminology

Key Terms and Definitions

Public Key: A cryptographic key shared openly, used to encrypt data or verify digital signatures.
Private Key: A secret key, kept confidential, used to decrypt data or create signatures.
Digital Signature: A cryptographic mechanism to verify the authenticity and integrity of data or code.
Certificate Authority (CA): A trusted entity that issues digital certificates to validate public keys.
Key Pair: The combination of a public and private key, mathematically linked for encryption and decryption.

Term	Definition
Public Key	Key used to encrypt data or verify a signature. Shared openly.
Private Key	Secret key used to decrypt or sign data. Kept confidential.
Asymmetric Encryption	Cryptographic system with public/private key pairs.
Digital Signature	A cryptographic proof that a message or artifact originated from a known source.
Key Pair	Combination of a public and private key.
Certificate Authority (CA)	Entity that issues digital certificates containing public keys.

How It Fits into the DevSecOps Lifecycle

Public key cryptography integrates into DevSecOps across the SDLC:

Plan: Define key management policies and compliance requirements for secure development.
Code: Sign code commits using tools like GPG to ensure developer authenticity.
Build: Secure container images or artifacts with signatures (e.g., Docker Content Trust).
Deploy: Use SSH keys for secure access to servers or cloud resources.
Operate: Encrypt sensitive data in transit and at rest within production environments.
Monitor: Verify logs and audit trails with digital signatures for integrity.

DevSecOps Phase	Public Key Role
Plan	Secure code signing strategies and key policies
Develop	Public key-based authentication for source control (e.g., SSH with Git)
Build/Test	Validate signed artifacts; enforce secure image scanning
Release	Sign containers or packages before promotion
Deploy	Encrypt secrets with public keys
Operate	Secure remote management using public-key-based SSH
Monitor	Ensure public key usage adheres to policy with audit logs

Architecture & How It Works

Components and Internal Workflow

Public key cryptography involves several components and processes:

Key Generation: Algorithms like RSA or Elliptic Curve Cryptography (ECC) create a mathematically linked key pair.
Encryption: The public key encrypts data, which only the corresponding private key can decrypt.
Digital Signatures: The private key signs data, and the public key verifies the signature to ensure authenticity.
Certificate Management: CAs issue digital certificates to establish trust in public keys.
Workflow:

A sender encrypts data using the recipient’s public key.
The recipient decrypts the data with their private key.
For signatures, the sender signs data with their private key, and the recipient verifies it with the sender’s public key.

Architecture Diagram (Description)

The architecture diagram illustrates public key cryptography in a DevSecOps pipeline:

Components:

Developer: Signs code commits with GPG.
Code Repository: Stores GPG-signed commits (e.g., GitHub, GitLab).
CI/CD Pipeline: Verifies signatures and signs build artifacts (e.g., Jenkins, GitLab CI).
Cloud Environment: Uses SSH for secure access and TLS for encrypted communication.
Certificate Authority: Issues certificates to validate public keys.

Flow:

The developer pushes signed commits to the repository.
The CI/CD pipeline verifies signatures and signs artifacts (e.g., Docker images).
Artifacts are deployed to a cloud environment using SSH/TLS.
The CA provides certificates to ensure trust in public keys.
The diagram shows a linear flow: Developer → Repository → CI/CD Pipeline → Cloud Environment, with the CA connected to the cloud for certificate issuance.

+-------------+        +----------------+       +---------------+
| Developer / |  SSH   | Git Repository |  CI   | Build Agent   |
| Automation  |<------>| (Public Key)   |<----->| (Private Key) |
+-------------+        +----------------+       +---------------+

+------------------+
| Vault / KMS      |
| (Public/Private) |
+------------------+

Integration Points with CI/CD or Cloud Tools

Public key cryptography integrates with DevSecOps tools:

Git: GPG signs commits and tags for code integrity.
Jenkins/GitLab CI: Validates signatures and encrypts pipeline secrets.
Docker: Signs container images using Docker Content Trust or Notary.
AWS/GCP/Azure: Uses Key Management Services (KMS) for key storage and TLS for secure APIs.

Tool	Integration
GitHub/GitLab	SSH key auth for repos; GPG key signing
Jenkins	Use credentials plugins to inject public/private keys
CircleCI/TravisCI	Encrypt secrets using GPG (public key)
Kubernetes	Encrypt secrets at rest with public key in KMS
AWS/GCP/Azure	Public key infrastructure for VM access, IAM roles

Installation & Getting Started

Basic Setup or Prerequisites

To implement public key cryptography (e.g., using GPG for Git commit signing), you need:

Operating System: Linux, macOS, or Windows.
Tools: GPG, OpenSSL, or SSH (depending on the use case).
Dependencies: Basic command-line knowledge and terminal access.
Optional: A Git client and access to a repository (e.g., GitHub).

Hands-on: Step-by-Step Beginner-Friendly Setup Guide

This guide demonstrates generating a GPG key pair and configuring Git to sign commits.

Install GPG:

On Ubuntu/Debian:

sudo apt update
sudo apt install gnupg

On macOS:
brew install gnupg

2. Generate a GPG Key Pair:

gpg --full-generate-key

Select RSA (default), key size (2048 or 4096 bits), and set an expiration (e.g., 1 year).
Enter your name and email (e.g., your.email@example.com).
Set a strong passphrase for the private key.

3. Export the Public Key:

   gpg --armor --export your.email@example.com > mypublickey.asc

This creates a file (mypublickey.asc) containing your public key.

Configure Git for Signing:

Set the signing key:
git config --global user.signingkey <your-key-id>
(Replace <your-key-id> with the key ID from gpg --list-keys.)
Enable automatic signing:
git config --global commit.gpgsign true

5. Share the Public Key:

Upload mypublickey.asc to a key server or Git hosting platform (e.g., GitHub’s GPG settings).

   gpg --keyserver keyserver.ubuntu.com --send-keys <your-key-id>

Sign a Commit:

git commit -m "Signed commit"

Git will use your GPG key to sign the commit, verifiable by others with your public key.

Real-World Use Cases

Scenarios in DevSecOps

Secure Code Signing: A DevSecOps team uses GPG to sign Git commits, ensuring only authorized developers contribute to the codebase. This prevents unauthorized code changes in critical applications.
Container Security: A company signs Docker images with Notary or Docker Content Trust, verifying image integrity before deployment to Kubernetes clusters.
API Security: An e-commerce platform uses TLS certificates to encrypt API communications, protecting customer data during transactions.
Compliance: A healthcare provider encrypts patient data in transit using public key cryptography to comply with HIPAA regulations.

Industry-Specific Examples

Finance: Banks use public key cryptography to secure API calls and sign transactions, ensuring trust and compliance with PCI-DSS.
Healthcare: Hospitals encrypt medical records in transit to meet regulatory standards.
Government: Agencies use SSH and TLS to secure classified communications and infrastructure access.

Benefits & Limitations

Key Advantages

Security: Provides strong encryption and authentication through separate keys.
Scalability: Public keys can be shared widely without compromising security.
Compliance: Meets regulatory requirements for data protection and integrity.
Non-repudiation: Digital signatures prove the authenticity of actions or data.

Common Challenges or Limitations

Key Management: Secure storage and rotation of private keys are complex and error-prone.
Performance: Asymmetric encryption is computationally slower than symmetric encryption.
Complexity: Requires expertise to configure and maintain, especially in large-scale systems.

Best Practices & Recommendations

Security: Store private keys in hardware security modules (HSMs) or secure vaults (e.g., AWS KMS, HashiCorp Vault).
Performance: Use hybrid encryption (combine symmetric and asymmetric cryptography) for large datasets to balance speed and security.
Maintenance: Rotate keys regularly and revoke compromised keys promptly using certificate revocation lists (CRLs).
Compliance: Align with standards like NIST 800-57 for key management and lifecycle policies.
Automation: Integrate key management with CI/CD tools (e.g., HashiCorp Vault for automated key generation and rotation).

Comparison with Alternatives

How It Compares with Similar Tools or Approaches

Criteria	Public Key Cryptography	Symmetric Cryptography
Security	High (separate keys for encryption/decryption)	Moderate (single shared key)
Speed	Slower (complex computations)	Faster (simpler algorithms)
Use Case	Authentication, key exchange, signatures	Bulk data encryption
Key Management	Complex (public/private pairs)	Simpler (single key)

When to Choose Public Key Cryptography

Use public key cryptography when:

Secure key exchange is needed without a pre-shared secret.
Authentication or non-repudiation is critical (e.g., code signing, identity verification).
Compliance requires strong encryption and digital signatures.
Choose symmetric cryptography for high-speed, bulk data encryption (e.g., encrypting large files or databases).

Conclusion

Public key cryptography is a cornerstone of DevSecOps, enabling secure communication, authentication, and data integrity across the SDLC. By integrating tools like GPG, SSH, and TLS into CI/CD pipelines and cloud environments, teams can build secure, compliant systems. As threats evolve, advancements like post-quantum cryptography will shape the future of public key cryptography in DevSecOps.

Next Steps:

Experiment with GPG or OpenSSL in a sandbox environment to practice key generation and signing.
Explore automated key management with tools like HashiCorp Vault.
Review compliance requirements for your industry and align cryptography practices accordingly.

Resources:

Public Key Cryptography in DevSecOps: A Comprehensive Tutorial