During an interview, I completely blanked when asked a basic question:
Which key is used to encrypt a file in public-key cryptography?
I blurted out “private key” — wrong!
Deep down I knew it wasn’t right, but my brain just wouldn’t compute in that moment.
So, I’m writing this post as a personal reminder (and maybe to help someone else too) on the practical use of public and private keys in file encryption.
Quick Recap: Public vs Private Keys
In public-key cryptography (often part of Public Key Infrastructure, or PKI), two keys are generated:
- Public Key – As the name suggests, it can be shared with anyone.
- Private Key – Must be kept secure and never shared. This key stays on the server or with the entity who owns the key pair.
These keys are mathematically linked. That means:
Anything encrypted with the public key can only be decrypted with the corresponding private key.
(And vice versa, but for encryption purposes, we’re sticking to this direction.)
I’m skipping the math, key generation, and algorithms for now — maybe for a future post.
The Scenario
Let’s say you need to securely transfer a sensitive file from your organization’s internal app server to your external partner’s server.
- Internal App Server: Server A
- External Partner Server: Server B
The requirement is to encrypt the file before sending, using SFTP.
Step-by-Step Flow
1. Key Generation (One-Time Setup)
Your partner (Server B) generates a public-private key pair:
- The private key is securely stored on Server B.
- The public key is shared with you (Server A).
2. File Encryption (You)
On Server A, you use Server B’s public key to encrypt the file.
3. File Transfer
You transfer the encrypted file over to Server B using HTTPS or SFTP.
4. File Decryption (Partner)
Server B uses its private key to decrypt the file.
That’s it!
I end with a simple sequence diagram that illustrates the step flows.
That interview question was a learning moment. Public-key cryptography can feel abstract, but when you map it to real-world scenarios like file transfers, it makes a lot more sense.
If you’re ever in doubt:
To securely send data to someone, encrypt it using their public key. Only their private key can decrypt it.Keep it simple. Keep it secure. Keep learning.
