Learn how Adaptive Multi-Factor Authentication combats data breaches, weak passwords, and phishing attacks.
Updated: 08/29/2024 - 11:27 Time to read: 6 minutesPKI, or public key infrastructure, encompasses everything used to establish and manage public key encryption. This includes software, hardware, policies, and procedures that are used to create, distribute, manage, store, and revoke digital certificates.
A digital certificate cryptographically links a public key with the device or user who owns it. This helps to authenticate users and devices and ensure secure digital communications.
PKI is one of the most common forms of internet encryption, and it is used to secure and authenticate traffic between web browsers and web servers. It can also be used to secure access to connected devices and internal communications within an organization.
Public key infrastructure has a long history of securing and authenticating digital communications with two main goals: to ensure the privacy of the message being sent and to verify that the sender is who they claim to be.
Public key infrastructure is an important aspect of internet security. It is the set of technology and processes that make up a framework of encryption to protect and authenticate digital communications.
PKI uses cryptographic public keys that are connected to a digital certificate, which authenticates the device or user sending the digital communication. Digital certificates are issued by a trusted source, a certificate authority (CA), and act as a type of digital passport to ensure that the sender is who they say they are.
Public key infrastructure protects and authenticates communications between servers and users, such as between your website (hosted on your web server) and your clients (the user trying to connect through their browser. It can also be used for secure communications within an organization to ensure that the messages are only visible to the sender and recipient, and they have not been tampered with in transit.
The main components of public key infrastructure include the following:
Public key infrastructure uses asymmetric encryption methods to ensure that messages remain private and also to authenticate the device or user sending the transmission.
Asymmetric encryption involves the use of a public and private key. A cryptographic key is a long string of bits used to encrypt data.
The public key is available to anyone who requests it and is issued by a trusted certificate authority. This public key verifies and authenticates the sender of the encrypted message.
The second component of a cryptographic key pair used in public key infrastructure is the private, or secret, key. This key is kept private by the recipient of the encrypted message and used to decrypt the transmission.
Complex algorithms are used to encrypt and decrypt public/private key pairs. The public key authenticates the sender of the digital message, while the private key ensures that only the recipient can open and read it.
The core of a public key infrastructure is trust. It is important for a recipient entity to know without a doubt that the sender of the digital certificate is exactly who they claim to be.
Trusted third-party CAs can vouch for the sender and help to prove that they are indeed who they say they are. Digital certificates are used to verify digital identities.
Digital certificates are also called PKI certificates or X.509 certificates. A PKI certificate offers proof of identity to a requesting entity, which is verified by a third party and works like a digital passport or driver’s license.
The PKI certificate will contain the following:
One of the most common uses of PKI is the TLS/SSL (transport layer security/secure socket layer), which secures encrypted HTTP (hypertext transfer protocol) communications.
Website owners will obtain a digital certificate from a trusted CA. To be issued a CA, the owner of the website will have to prove that they are indeed the actual owner. Once verified, the website owner can purchase an SSL certificate to install on the web server. This tells the browser that it is the legitimate website the browser is trying to access.
The TLS/SSL protocol relies on a chain of trust, where the user has to trust the root-certificate granting authority. An alternative scheme is the web of trust, which uses self-signed certificates that are validated by a third party. Web of trust is often used in smaller communities of users, such as within an organization’s self-contained network.
Additional uses for PKI include the following:
Open-source public key infrastructure is publicly available. Examples of open-source PKI include the following:
Major browsers and operating systems, such as Apple and Microsoft, publish trust stores that provide a list of trusted root certificates. A trusted root certificate is necessary to instill trust in the provided digital certificate and coinciding CA. A trusted CA is a vital aspect of a public key infrastructure.
PKI uses asymmetric cryptography to encrypt and decrypt digital messages. For more information on asymmetric encryption and the use of public and private cryptographic keys, Okta can answer your questions. Contact us today.
OpenSSL. (2021). The OpenSSL Project Authors.