Why PKI and Digital Certificates

Public key infrastructure and digital certificates — we're just going to scratch the surface with this, so we understand what public key infrastructure is and what these digital certificates are. We're going to actually take a look at some of those digital certificates, but this is to get a good concept of what public key infrastructure is and what it's used for.

A quick review of RSA

RSA is an encryption cipher that does some really cool stuff. It uses asymmetric keys, which means that what is used to encrypt is a different key than what is used to decrypt. It's pretty cool, and we can do some pretty awesome stuff with this.

Let's use an example of a user accessing a web server and see what things we can do with this. First of all, if we want to send confidential information, this web server can give this user its private key, and now this user can encrypt something — for instance, a shared key that is going to be used for encryption in the future — can encrypt something with this public key, send it across the public network, no one else can decrypt it, and once it gets to the web server, the web server can use the private key to decrypt it. So that's pretty cool.

The other thing it can do is verify identity. It can verify that whatever this public key is, it is associated with a certain private key. That in itself doesn't necessarily confirm somebody and who they are, and doesn't necessarily confirm authenticity, but it helps in this process. What we can do is, this web server gives this user its public key, and then it can encrypt data using this private key and send it to this user, and if this user can unencrypt that data with this public key, then this user knows that this public key is associated with that private key that sent the data. So this is a way of verifying some sort of identity. We call this public key cryptography.

Digital certificates

What's actually being exchanged here is what's called a digital certificate. A digital certificate contains the public key, so the public key gets inserted into this digital certificate, and this digital certificate gives it extra information — information such as what the expiration date is of the digital certificate, not necessarily the expiration of the public key, but of the certificate itself. That is then sent to this user, and then that user has access to the public key through this digital certificate.

I'm on a Windows box here, and what I'm going to do is click the Windows button and type in search, and what comes up is manage computer certificates. So I'm going to manage computer certificates. It's going to give me this UAC here, so I'll click on yes to accept, and it brings up a management console for certificates. It's got the tree over here of different certificates that we can get into, and what I'm going to do is look at this trusted root certificate authority, and we're going to take a look at these certificates.

There are a lot of different certificates in here. I'm just going to open up one. We have one from Microsoft, might as well open that one up and see what it looks like. We've got Microsoft, and this one looks like it's expired — we've got a Microsoft Root Authority, it's from 1 191 1997 to 1230 2020. But it doesn't matter that it's expired, we're just going to take a look and get an idea what these certificates look like.

The version is version three. Each of these certificates has different versions to it, and version three is the standard version now that we're on. We have the validity date, we already took a look at the validity dates there. Then the public key: here is the public key. This is what I was saying, that the public key goes inside of the certificate. We've got this hex number here of the public key, it's 248 bits that are in that, and then some other information in regards to this as well. So we have this certificate on this machine, and this is what a digital certificate looks like.

Third-party trust and public key infrastructure

A digital certificate isn't enough for authenticity. That is, anybody can generate a public/private key pair, anybody can create one of these digital certificates. So just this web server sending over a digital certificate with a public key in itself doesn't verify who this web server is. All you can do at this point in time is verify that there is an association between this private key and this public key, because the public key can decrypt something that the private key sends.

What we need is a trusted third party, somebody that both the user and the web server trust, and we call this public key infrastructure. One thing to note: this is not public key cryptography. Public key cryptography is this idea where we have a private and public key, so it is a component of public key infrastructure, but only a component of it. Public key infrastructure is a much bigger aspect: it includes some sort of trusted third party, so that when you have this certificate you can use this trusted third party to validate this digital certificate that you received. That way you can verify that this web server is who that web server says they are.

So it is a form of authenticity. It's not authentication — we're not actually authenticating — but we're making sure that the data that this web server is sending this user is authentic, that it is from who it says that it's from.

Seeing it in the browser

Let's see what this looks like in real life. What I've done is I pulled up a Chrome browser and browsed to techknowsurge.com. Specifically, it's showing me the newsletter signup page. This is the page that was downloaded, and it was encrypted. I know it was encrypted because it used HTTPS — the S at the end of it means that this was encrypted and then I decrypted it. It also has been verified through a certificate authority, so with the certificate authority I verified that this is actually authentic, it's coming from the actual techknowsurge.com web servers.

What does that look like? I can give you some more insight into it. We can click on this little lock right here and go down to connection is secure. I'm going to click on that, and it says certificate is valid, so it validated the certificate. The web server gave me the certificate, and I validated that that was a valid certificate, and then I used the public key inside of that certificate to decrypt this website. So now I know the website has integrity to it, and authenticity.

I'm going to click on this certificate is valid, and I can see that public key inside of here that was used to decrypt this message. I can also look at additional details here, and as I scroll through, some of the information is — where's that trusted third party? I can click on here to see that trusted third party, who is the CA issuer. That is the certificate authority, that trusted third party that was used to make sure that this was an authentic website.

So that's what a digital certificate looks like, that's how it uses that public and private key, and that's how it makes sure that the page that I received was in fact encrypted and also authentic, from the correct web servers.

RSA has that public and private key, and at least the public key is incorporated into a digital certificate. Third-party trust is where we both trust a third party who validates that certificate, and the fact that I can then unencrypt that data that was encrypted by the private key provides me a certain amount of authenticity and also integrity. So that is public key infrastructure and how public key infrastructure is set up.