Linux Today: Linux News On Internet Time.

More on LinuxToday

Security Portal: Why Are Keys Certified?

Aug 08, 2000, 08:14 (1 Talkback[s])
(Other stories by John Savard)

"Key certificates are an important element in the use of public-key cryptography (PKC). Your browser, when it visits a secure site, checks for a key certificate from a small number of commercial certificate providers. The instructions that came with PGP described how to sign keys, and explained the importance of doing so. The concept of a public-key infrastructure (PKI) refers to what is essentially a way to facilitate key certification, perhaps with government assistance."

"This is because of what would otherwise be a fatal weakness in public-key cryptography."

"Using ordinary cryptography, that is, a conventional or symmetric algorithm, you and the person with whom you are exchanging messages are the only two people who share the secret key that had to have been exchanged in advance, face to face, ahead of time."

"Public key cryptography removes the need for a face to face meeting in advance. Preparing a secret message only requires the use of the public key, but unscrambling it again requires the private key, and it is not feasible to derive the private key from the public key. So, to send a message to someone, you use that person's public key to encipher it, and then he or she can use his or her own private key to read it."

Complete Story

Related Stories: