All cryptographic systems require some form of key exchange. If there are only a few users engaged in a long-term relationship, then it may be possible to exchange keys over a secure private channel, such as by the use of a trusted courier. Then the security of the system is no better than the security of the private channel. If there are a great number of users in a network, however, and their relationships are unpredictable, unforeseen, and brief, then it is inappropriate to have a single shared key, and it is unreasonable to have an individual private key for each pair of users. Consequently, public-key cryptosystems are unavoidable. The keys must be exchanged, or created, over a public channel, but in a way that cannot be reproduced or broken by an adversary.

The earliest public-key cryptographers used the fact that the factoring of large composite integers is apparently very hard. The historical evidence for this premise was compelling and remains so; mathematicians had been searching for suitable integer-factoring algorithms for hundreds of years with very limited success. Since the introduction of such public-key cryptosystems, there has been a continuing intense effort to find methods of factoring large composite integers. Accordingly, improved methods of factoring integers have been found, but these improvements are modest. For large n, even these improved methods of factoring are still impractical.