This is a quick summary of digital certificates and private-public key cryptography, gleaned from Wikipedia.
Digital Certificates use private-public key pairs to keep data private, and to prevent from undetected alterations.
Encryption provides privacy. Only those who have the key can read (decrypt) the data. See Confidentiality.
Message digests or check sums protect data from (undetected) alteration. A message digest is a hash code calculated from the plain text contents of the message or document. If a message is altered, its message digest will change, and will not match the original message’s hash code.
The hash algorithm is public, so that the receiver can verify the message digest has not been altered.
The hash code is public. It is protected by the encrypted message. If the hash code is altered, it will not match the message digest.
A hacker could construct a bogus or altered message by supplying a different message, calculating a new hash code, and supplying a new public key.
The public key is protected by its private key. The public key can only be with the associated private key.
A hacker could use a valid but different private-public key pair. Without a separate means to verify the public key this exploit cannot be detected.
A Digital Certificate provides a chain of trust from a certifying authority to the owner of the certificate, and its private-public key pair. The CA can offer evidence as to the owner of the certificate. The CA can also invalidate an existing certificate, if it is reported stolen.
A digital certificate is protected using the same scheme of encryption and hash codes. The certificate is encrypted with the CA’s private key. The chain stops at the CA’s root certificate. Its private key is physically protected. Ultimately the receiver decides to trust (or not) the chain based on the reputation of the CA.
Based on the reputation of the CA, the receiver ultimately decides to trust the entire chain or not.
The chain is not vulnerable, but the ends are. A hacker may gain access to the root certificate of the end-user’s private key. This is why it is important to secure private keys. Many applications protect the use of private keys with a password.
The term public-private key pair refers to the two numbers that are generated together. Each half of the pair has specific uses. One key cannot be used to generate the other. If one key is used to encrypt a message, the other must be used to decrypt.
The private key is used to keep information private. The public key is used to protect information from alteration. They may be used in either order, for different purposes.
One key (in the pair) is used to encrypt clear (easily read) text. The second key is required to decrypt the encrypted message (cipher text). In the familiar foreign agent scenario, the sender (agent) wants the message to be secret until it is decoded at headquarters. In this case, the sender uses a public key to encrypt the message. Multiple agents may use the same key. The public key does not allow them to read encoded messages, only to encrypt them from plain text. The modern day scenario might be a bank sending sensitive data to a customer. Each customer would have his own private key.
The more common scenario on the Internet is a publisher that wants to ensure its customers that a product is from the publisher and has not been altered. In this case, the publisher encrypts the message with its private key. End users obtain the public key from the message itself. They can validate the public key by contacting the publisher.
Encryption translates plain text into “secret” text, called cipher text.
Cipher text is unreadable (confidential) without the proper key.
Decryption renders cipher text into readable plain text. Decryption is often thought of as the “reverse” of encryption, using the same key for the process. This is called secret key cryptography.
Public-key cryptography uses one key for encryption, and requires a different key decryption.
Authentication is the process of validation the identity of a user or the source of a document.
Confidentiality means keeping information secret; private.
Integrity means protecting a document from alteration.
Non-repudiation means that the receiver can rely on document and signature as authentic; not a forgery. Repudiation is a legal way to invalidate a contract; claiming the signature was not made by the party represented. If someone signs your name to a credit card slip, you are not responsible for the charge.
A Digital Signature, unlike a handwritten signature, is a different value for each message that it covers. It is not a single static, secret code that can be copied on to different documents. It is made up of the owner’s private key and the message digest. This protects the scope of the signature to exactly the message that was signed.
A Public key certificate is also called a Digital Certificate.
Updated 2/28/2009 5:47:55 PM