What's the use of the Public and Private key for reCAPTCHA?

Question

reCAPTCHA requires a public and a private key before it can be implemented into a website. It also needs the reCAPTCHA keys depending on the website. What's the reason behind this? Does the Public and Private key affect the words displayed in the reCAPTCHA? I know that I can set the Public and Private key to be GLOBAL in which it can be used for other domains but why even need the keys in the first place?

Answer 1

OK. This is my guess, no guarantee.

1. Your public key is required while generating client-side page.
2. The client uses this public key to request from recaptcha: an image, a corresponding correct answer and perhaps an id. Of course the answer and the id comes encrypted, using the public key. (So the client cannot know the answer)
3. User types in the answer, sends it to your server.
4. You have: {id, answer} encrypted using public key. You send your private key and this encrypted message to recaptcha server.
5. recaptcha unencrypts the message, revealing the answer and id, and checks if they match.
6. it tells your server the result of the check.

Note:

1. If the user sends a public key of his own to recaptcha, the check won't succeed since your private key does not work with his public key.
2. The scheme proves that your server is really the one receiving the recaptcha answer.