Public Key Infrastructure
TL;DR: Public Key Infrastructure (PKI) uses trusted third parties to verify that a public key belongs to a specific person, ensuring that when you send a secret message, you are actually talking to who you think you are.
The Identity Crisis of the Internet
In Station 11, we explored how asymmetric keys allow us to lock a message so that only the holder of a private key can open it. But here is the catch: how do you know that the public key you just downloaded belongs to your friend, and not to an impostor sitting in the middle of your connection? If you use a fake key, the impostor can read your secrets, and you would be none the wiser. This is the fundamental problem of digital identity.
To solve this, we rely on , or PKI. Think of PKI as the digital equivalent of a passport office. You wouldn't trust a random person on the street claiming to be a government official, but you trust the passport because it is stamped by an authority that everyone recognizes. In the digital world, we call these authorities (CAs).
How Digital Certificates Work
When a company or a person wants to be trusted, they go to a CA. They provide proof of who they are, and the CA issues them a . This certificate contains the owner's name, their public key, and a digital signature from the CA itself. Because your computer already has a list of trusted CAs built into it, it can verify the CA's signature on the certificate. If the signature is valid, you know the public key is legitimate.
This process creates a chain of trust. You don't need to know the person you are communicating with; you only need to trust the authority that vouched for them. This is exactly how your web browser knows that the "https" lock icon on your bank's website is actually protecting your data, rather than connecting you to a malicious site designed to steal your credentials.
Signing for Authenticity
Now, let's look at the mechanics of verification. We know that a private key is used to decrypt messages, but it also has another superpower: it can "sign" data. When you want to prove that you sent a message, you use your private key to create a unique for that data.
The Signing Protocol
Procedure · 7 steps- 1The sender creates a message.
- 2The sender runs the message through a hash function to create a unique digital fingerprint.
- 3The sender encrypts that fingerprint with their private key to create the signature.
- 4The sender attaches the signature to the message and sends both to the receiver.
- 5The receiver uses the sender's public key to decrypt the signature and reveal the fingerprint.
- 6The receiver calculates the fingerprint of the message themselves.
- 7If the two fingerprints match, the message is authentic and has not been altered.
This mechanism ensures two things: first, that the message definitely came from the owner of the private key, and second, that not a single bit of the message was tampered with during transit. If even one character is changed, the fingerprints will not match, and the receiver will know the message is untrustworthy. It is a brilliant, mathematical way to ensure that digital communication remains as reliable as a wax seal on a physical letter, but with the speed of light.
Public Key Infrastructure creates a system of digital trust by using trusted authorities to confirm that a public key belongs to a specific person, allowing us to verify identity and data integrity across the internet.
Now that you understand how to prove who you are and ensure your messages haven't been tampered with, we are ready to move to the next level: Station 13, where we explore the formal world of Digital Signatures in greater detail.