Web Security and Commerce

Public Key Infrastructure

The last piece of the cryptography puzzle is a system for establishing the identity of people who hold cryptographic keys. In recent years, such a system has come to be called the public key infrastructure, as we discussed in Chapter 6.

Recall that public key encryption systems require that each user creates two keys:

• A public key, which is used for sending encrypted messages to the user and for verifying the user’s digital signature.

• A secret key, which is used by the user for decrypting received messages and for signing the user’s digital signature.

While secret keys are designed to be kept secret, public keys are designed to be published and widely distributed.

Schematically, you might imagine that public and secret keys contain little information other than the actual values that are needed for public key encryption and decryption, as shown in Figure 10.4.

Figure 10-4.  A simplistic idea for storing public and secret keys

It turns out, though, that we need to store more information with each public key. In addition to the encryption information, we may wish to store the user’s name (see Figure 10.5) or some other kind of identifying information. Otherwise, if we had public keys for three people—say, Sascha, Wendy, and Jonathan—there would be no easy way to tell them apart. And we need to store more information with each secret key, so we have a way of telling ...