Section 8.74 Public Key Infrastructure (PKI)

Question 1

Public Key Infrastructure (PKI)

H.S.P.P.P

Answer 1

An entire system involving hardware, software, policies, procedures, and people that is based on asymmetric encrytpion

■ Facilitates secure data transfer, authentication, and encrypted communications

■ Used in HTTPS connections on websites

System that creates asymmetrical key pairs that consist of those public and private keys that are used in the encryption and decryption process.

Question 2

Establishing a Secure Connection

Answer 2

■ User connects to a website via HTTPS

■ Web browser contacts a trusted Certificate Authority for the web server’s Digitial Certificate and Public key. This information is sent to the web browser encrypted with a private key. The web browser will verify the Digitial Certificate of the web server by decrypting the message with the Certificate Authorities Public Key. Once decrypted, the browser conducts a verification of the digital certificate.

■ A random shared secret key is generated for symmetric encryption

■ The shared secret is securely transmitted using the web servers public key encryption

■ The web server decrypts the shared secret with its private key

■ Both parties use the shared secret for symmetric encryption (e.g AES) to create
a secure tunnel for fast communication.

Confidentiality
● Data is encrypted using a shared secret

Authentication
● The web server’s identity is verified using its private key
■ Visual indicators like a padlock show secure communication

Question 3

Public Key Infrastructure vs. Public Key Cryptography

Answer 3

Public Key Infrastructure (PKI)

● Encompasses the entire system for managing key pairs, policies, and trust
● Involves generating, validating, and managing public and private key pairs
that are used in the encryption and decryption process
● Ensures the security and trustworthiness of keys

Public Key Cryptography:

● Refers to the encryption and decryption process using public and private
keys
● Only a part of the overall PKI architecture

Question 4

Key Escrow

Answer 4

Storage of cryptographic keys in a secure, third-party location (escrow) which enables key retrieval in cases of key loss or for legal investigations

Security Concerns:
● Malicious access to escrowed keys could lead to data decryption
● Requires stringent security measures and access controls

■ Relevance in PKI: In PKI, key escrow ensures that encrypted data is not permanently inaccessible

Useful when individuals or organizations lose access to their encryption keys