Integrity - PKI and Digital Certificates

A Quick Review of RSA

RSA is an encryption cipher that does some really cool stuff. It uses asymmetric keys, which means that what is used to encrypt it is a different key than what is used to decrypt it. So it's pretty cool, and we can do some pretty awesome stuff with this.

Let's use an example of a user accessing a web server and see what things that we can do with this. First of all, if we want to send confidential information, this web server can give this user its private key, and now this user can encrypt something, for instance a shared key that is going to be used for encryption in the future, can encrypt something with this public key, send it across the public network, no one else can decrypt it, and once it gets to the web server, the web server can use the private key to decrypt it. So that's pretty cool.

The other thing that it can do is it can verify identity. It can verify that whatever this public key is, it is associated with a certain private key. So that in itself doesn't necessarily confirm somebody and who they are, and doesn't necessarily confirm authenticity, but it helps in this process. What we can do is this web server gives this user its public key, and then it can encrypt data using this private key, send it to this user, and if this user can unlock that data, or unencrypt that data, with this public key, then this user knows that this public key has been sent from this private key via that data. So this is a way of verifying some sort of identity of this user, and so we call this public key cryptography.

Digital Certificates

What's actually being exchanged here is what's called a digital certificate. A digital certificate contains the public key, so the public key gets inserted into this digital certificate, and this digital certificate gives it extra information, information such as what the expiration date is of the digital certificate, not necessarily the expiration of the public key, but of the certificate itself. That is then sent to this user, and then that user has access to the public key through this digital certificate.

Let's take a look at what those digital certificates look like. I'm on a Windows box here, and what I'm going to do is I'm going to click the Windows button and type in search, and what comes up is manage computer certificates. So I'm going to manage computer certificates. It's going to give me this UAC here, so I'll click on yes to accept, and it brings up a management console for certificates. It's got the tree over here of different certificates that we can get into, and what I'm going to do is I'm going to look at this trusted root certificate authority, and we're going to take a look at these certificates.

So a lot of different certificates in here. I'm just going to open up one. We have one from Microsoft, might as well open that one up and see what it looks like. So we've got Microsoft, and this one looks like it's expired. We've got a Microsoft Root Authority. It's from 1/19/1997 to 12/30/2020. But that doesn't matter that it's expired, we're just going to take a look and get an idea what these certificates look like.

The version is version three. So each of these certificates have different versions to it, and version three is the standard version now that we're on. We have the validity date, we already took a look at the validity date there. The public key to it, so here is the public key. This is what I was saying, that the public key goes inside of the certificate. We've got this hex number here of the public key. It's 248 bits that are in that, and then some other information in regards to this as well. So we have this certificate on this machine, and this is what a digital certificate looks like.

Third-Party Trust

A digital certificate isn't enough for authenticity. That is, anybody can generate a public private key pair, anybody can create one of these digital certificates. So just by this web server sending over a digital certificate with a public key, in itself doesn't verify who this web server is. All you can do at this point in time is verify that there is an association between this private key and this public key, because the public key can decrypt something that the private key sends.

What we need is a trusted third party, somebody that both the user and the web server trusts, and we call this public key infrastructure. One thing to note, this is not public key cryptography. Public key cryptography is this idea where we have a private and public key, so it is a component of public key infrastructure, but only a component of public key infrastructure. Public key infrastructure is a much bigger aspect. It includes some sort of trusted third party, and when you have this certificate, you can use this trusted third party to validate this certificate, this digital certificate that you received, so that way you can verify that this web server is who that web server says they are. So it is a form of authenticity. It's not authentication, we're not actually authenticating, but we're making sure that the data that this web server is sending this user is authentic, that it is from who it says that it's from.

What This Looks Like in a Browser

Let's see what this looks like in real life. What I've done is I pulled up a Chrome browser and browsed to techknowsurge.com. Specifically it's showing me the newsletter signup page. So this is the page that was downloaded, and it was encrypted. I know it was encrypted because it used HTTPS, the S at the end of it means that this was encrypted, and then I decrypted it. And it also has been verified through a certificate authority, so with the certificate authority I verified that this is actually authentic, it's coming from the actual techknowsurge.com web servers.

So what does that look like? Well, I can give you some more insight into it. We can click on this little lock right here and go down to connection is secure. I'm going to click on that and it says certificate is valid. So it validated the certificate. The web server gave me the certificate and I validated that that was a valid certificate, and then I used the public key inside of that certificate to decrypt this website. So now I know the website has integrity to it and authenticity.

So I'm going to click on this certificate is valid, and I can see that public key inside of here that was used to decrypt this message. I can also look at additional details here, and as I scroll through here, some of the information is, where's that trusted third party? Well, I can click on here to see that trusted third party, who is the CA issuer. So that is the certificate authority, or that trusted third party that was used to make sure that this was an authentic website.

So that's what a digital certificate looks like, that's how it uses that public and private key, that's how it makes sure that the page that I received was in fact encrypted and also was authentic from the correct web servers.

Wrapping Up

We did that quick review over what RSA is, with that public and private key and how that's incorporated, or at least the public key is incorporated, into a digital certificate. We took a look at what a third-party trust looks like, where we both trust a third party who validates that certificate, and the fact that then I can unencrypt that data that was encrypted by the private key. That provides me a certain amount of authenticity and also integrity. So that is public key infrastructure and how public key infrastructure is set up.