Public Key Infrastructure Flashcards
Security+
What is PKI?
A framework consisting of policies, procedures, hardware, software, and people to manage digital certificates.
What are the main functions of digital certificates in PKI?
Create, distribute, manage, store, and revoke.
Why is planning important in PKI?
Because implementing PKI is a complex endeavor that requires significant preparation.
What does PKI bind public keys to?
Individuals or devices.
What is the role of a certificate authority in PKI?
It issues and manages digital certificates, establishing trust.
What is symmetric encryption?
A method that uses a single shared key for both encryption and decryption.
What happens if the symmetric key gets compromised?
A new key will need to be generated and distributed.
Why doesn’t symmetric encryption scale well?
Because it can be challenging to distribute the shared key securely among many users.
What is an advantage of symmetric encryption?
It is fast and has less overhead compared to asymmetric encryption.
How is symmetric encryption often used in practice?
It is commonly combined with asymmetric encryption for efficiency.
What defines asymmetric encryption?
It uses two (or more) mathematically related keys: a private key and a public key.
What is the purpose of a private key in asymmetric encryption?
It must be kept secret and is used to decrypt data encrypted with the corresponding public key.
What can anyone do with a public key?
They can view and distribute it freely.
Can the private key be derived from the public key?
No, it is mathematically infeasible to derive the private key from the public key.
How is a key pair generated in asymmetric encryption?
Both the public and private keys are built simultaneously using randomization and mathematical algorithms.
What is key escrow?
A process where a third party holds your private keys for decryption.
Why might key escrow be a legitimate business arrangement?
Businesses or government agencies may need access to encrypted information for compliance or operational needs.
What are the concerns regarding key escrow?
It can be controversial due to privacy and security implications.
What is essential for managing keys in PKI?
Clear processes and procedures to ensure trust and control over access to keys.
Under what conditions might a third party access encryption keys?
In controlled situations like legal proceedings or court orders.
