Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The RSA algorithm is used for encryption (plain text to cipher text) and decryption (cipher text to plain text) of data. What is the need for using public keys in these sites; why is data is encrypted as everything is viewed by everyone?
Why do we need to use public key cryptography in Google; how does it provide security?
[I assume you're talking about Google's web search service, and not Gmail.]
Google doesn't encrypt the web page data in storage, because it's not secret data. Encryption is optionally used by users to securely communicate with Google, and that's different.
Using certificate based keys and encryption assures the users that they are communicating with the Real Google and not a Fake Google that could give them false results. It also protects the users' privacy from eavesdroppers; so if someone was searching for 'cancer' their employer or family wouldn't know.
Google explains here why they redirect your search to https.
As search becomes an increasingly customized experience, we recognize the growing importance of protecting the personalized search results we deliver. As a result, we’re enhancing our default search experience for signed-in users. Over the next few weeks, many of you will find yourselves redirected to https://www.google.com (note the extra “s”) when you’re signed in to your Google Account. This change encrypts your search queries and Google’s results page. This is especially important when you’re using an unsecured Internet connection, such as a WiFi hotspot in an Internet cafe.
Facebook, GMail etc have a login username/password. So there one of the reasons for https is so that your password doesn't go in clear text. As to why these sites do end to end https rather than using just https for the username/password part - you can see this Q & A here.
It isn't.
First of all, RSA is nowadays usually only used for authentication when used in TLS. And authentication is performed using signature generation, not encryption. Sometimes this is called e.g. SHA-256 with RSA encryption but that's a kind of misnomer. Starting with TLS 1.3, RSA encryption will not be used at all anymore.
But mainly the client certificates used by Google use Elliptic Curve cryptography (ECDSA) in general. So the key agreement - which determines the symmetric keys used to encrypt the traffic - is performed using ECDH key agreement and the authentication is then performed using the ECDSA private key on the server and the certificate containing the public ECDSA key send to the client.
Previously RSA encryption of the master secret was commonplace, but that doesn't give you forward secrecy, so it is being phased out.
Here is a picture of the security provided by the Google site. RSA is only used to verify the server certificate, not to secure the connection itself. Similar story for Facebook.
Note that browsers that do not support ECC cipher suites may still use RSA certificates.
The reason why the connection is secured is given by the other answers.
They use a symmetric cipher on top of RSA or ECC because symmetric ciphers are more secure.
However if they relied only on symmetric keys they would have to sync each key with a dedicated key server for every account on the network. That would be millions of keys being synced with Diffie-Hellmen at the same time. This would be a DDoS nightmare for traffic and bandwidth and cause the whole thing to essentially grind to a halt in no time flat.
Not to mention if the key server is breached then every one of those millions of accounts would have to generate a new key and sync it with the server again. An action that would effectively DDoS the network once more.
