A visual guide to public-key cryptography
How Airlines Prove Your Ticket Is Real
Every boarding pass you've ever used was secured by a pair of mathematical keys. Here's how that works.
The problem
What Stops a Fake Ticket?
When you buy a plane ticket, the airline sends you a digital boarding pass. It contains your name, flight number, seat assignment, and a barcode.[1]
But a boarding pass is just data. Without cryptographic protection, anyone with a text editor could forge one. In fact, before airlines adopted digital signatures, boarding pass fraud was a documented security concern raised by the U.S. Government Accountability Office.[2]
The answer is public-key cryptography — a system where the airline can prove it created the ticket, and anyone can verify that proof, without sharing any secrets.[3]
The foundation
Two Keys, One Identity
The airline generates a key pair — two mathematically linked numbers. One is kept secret; the other is published openly. Together, they form the basis of all digital signatures.[4]
Private Key
Known only to the airline. Stored in tamper-resistant hardware security modules (HSMs).[5] Used to sign tickets.
Public Key
Shared openly — with airports, TSA, and verification systems worldwide. Used to verify signatures.
The mathematical relationship is a one-way function: knowing the public key reveals nothing about the private key. This property, based on the difficulty of factoring large numbers (RSA) or computing discrete logarithms on elliptic curves (ECDSA), is what makes the entire system secure.[6]
Step by step
Signing the Ticket
When the airline issues your boarding pass, it creates a digital signature — a mathematical stamp that proves origin and integrity.[7]
Assemble the ticket data
Passenger name, flight number, date, seat — all fields that define the ticket.
Hash the data
A hash function (SHA-256) compresses all the ticket data into a fixed-length fingerprint — 256 bits, regardless of input size.[8]
Encrypt the hash with the private key
The hash is mathematically transformed using the airline's private key. The result is the digital signature.
Attach the signature
The signature is embedded in the boarding pass barcode alongside the original data.[9]
At the gate
Verifying the Ticket
When you scan your boarding pass at security or the gate, the system runs the verification process in milliseconds.[10]
Read the ticket data and signature
The scanner extracts both the original data and the attached signature from the barcode.
Re-hash the ticket data
The same SHA-256 function produces Hash A from the ticket data.
Decrypt the signature with the public key
The airline's public key reverses the signature back into Hash B.
Compare the hashes
If Hash A equals Hash B, the ticket is authentic and unmodified. If they differ, the ticket has been forged or tampered with.
Valid Ticket
Hash A = Hash B
Data is untouched. Signature was created by the airline's private key. Board the plane.
Tampered Ticket
Hash A ≠ Hash B
Even changing one character breaks the signature. The forgery is instantly detected.
The math
Why Forgery Is Impossible
One-way functions
The public key is derived from the private key through a mathematical operation that's easy to compute forward but computationally infeasible to reverse. For RSA, this relies on the difficulty of factoring the product of two large primes. For ECDSA, it relies on the elliptic curve discrete logarithm problem.[6]
Collision resistance
SHA-256 produces a unique fingerprint for every input. Finding two different inputs that produce the same hash would require approximately 2128 operations — more than all the computers on Earth could perform before the heat death of the universe.[8]
Public Key Infrastructure (PKI)
Airlines distribute their public keys through trusted certificate authorities, the same infrastructure that secures HTTPS. Airports and government agencies maintain registries of airline public keys, ensuring you're verifying against the real airline, not an impostor.[11]
Hands on
Try It Yourself
This demo uses the Web Crypto API — real ECDSA cryptography running in your browser.[12] Generate a key pair, sign a ticket, verify it, then try tampering.
Takeaway
The Private Key Signs. The Public Key Verifies.
This same principle — a secret key that creates proofs, and a public key that checks them — secures far more than airline tickets.
HTTPS
Every padlock in your browser uses the same key-pair system to prove a website is who it claims to be.[13]
Cryptocurrency
Bitcoin transactions are authorized by signing with a private key, verifiable by anyone on the network.[14]
Software Updates
Your operating system verifies that updates were signed by the vendor before installing them.[15]