Public Key Infrastructure (PKI) – in Cryptography

What You’ll Learn 📚

• Core concepts of PKI
• Key terminology
• Simple and complex examples
• Common questions and answers
• Troubleshooting tips

Introduction to PKI

Public Key Infrastructure (PKI) is a system that helps manage digital certificates and public-key encryption. It’s a crucial part of securing communications over the internet, ensuring that data is exchanged securely and that the parties involved are who they claim to be.

Core Concepts

At its heart, PKI involves a few key components:

• Public and Private Keys: These are cryptographic keys used to encrypt and decrypt data. The public key is shared openly, while the private key is kept secret.
• Digital Certificates: These are electronic documents that use a digital signature to bind a public key with an identity.
• Certificate Authorities (CAs): Trusted entities that issue digital certificates.

Key Terminology

• Encryption: The process of converting information into a secure format that can only be read with the correct key.
• Decryption: The process of converting encrypted information back into its original form.
• Digital Signature: A cryptographic value that is calculated from the data and a secret key known only by the signer.

Simple Example

Progressively Complex Examples

Example 1: Basic Key Pair

# Importing necessary library
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization

# Generate a private key
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048
)

# Generate a public key
public_key = private_key.public_key()

# Serialize keys
private_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.TraditionalOpenSSL,
    encryption_algorithm=serialization.NoEncryption()
)

public_pem = public_key.public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo
)

print(private_pem.decode())
print(public_pem.decode())

Example 2: Signing and Verifying a Message

from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding

# Message to sign
message = b'This is a secret message'

# Sign the message
signature = private_key.sign(
    message,
    padding.PSS(
        mgf=padding.MGF1(hashes.SHA256()),
        salt_length=padding.PSS.MAX_LENGTH
    ),
    hashes.SHA256()
)

# Verify the signature
try:
    public_key.verify(
        signature,
        message,
        padding.PSS(
            mgf=padding.MGF1(hashes.SHA256()),
            salt_length=padding.PSS.MAX_LENGTH
        ),
        hashes.SHA256()
    )
    print('Signature is valid!')
except Exception as e:
    print('Signature is invalid:', e)

Example 3: Creating a Digital Certificate

from cryptography import x509
from cryptography.x509.oid import NameOID
import datetime

# Create a certificate
subject = issuer = x509.Name([
    x509.NameAttribute(NameOID.COUNTRY_NAME, u'US'),
    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, u'California'),
    x509.NameAttribute(NameOID.LOCALITY_NAME, u'San Francisco'),
    x509.NameAttribute(NameOID.ORGANIZATION_NAME, u'My Company'),
    x509.NameAttribute(NameOID.COMMON_NAME, u'mycompany.com'),
])

certificate = x509.CertificateBuilder().subject_name(
    subject
).issuer_name(
    issuer
).public_key(
    public_key
).serial_number(
    x509.random_serial_number()
).not_valid_before(
    datetime.datetime.utcnow()
).not_valid_after(
    datetime.datetime.utcnow() + datetime.timedelta(days=365)
).sign(private_key, hashes.SHA256())

print(certificate)

Common Questions and Answers

1. What is the difference between a public key and a private key?

   A public key is shared openly and used to encrypt data, while a private key is kept secret and used to decrypt data.

2. Why do we need digital certificates?

   Digital certificates verify the identity of the entities involved in communication, ensuring that the public key belongs to the entity it claims to.

3. How does PKI enhance security?

   PKI provides a framework for secure communication by managing keys and certificates, ensuring data integrity, confidentiality, and authenticity.

4. Can a digital signature be forged?

   Digital signatures are highly secure and difficult to forge due to the cryptographic algorithms used. However, if a private key is compromised, signatures can be forged.

Troubleshooting Common Issues

• Key Mismatch: Ensure that the public and private keys are correctly paired. A mismatch will result in decryption errors.
• Invalid Signature: Double-check the message and signature. Any change to the message will result in an invalid signature.
• Certificate Expiry: Certificates have an expiration date. Ensure that the certificate is valid and not expired.

Remember, practice makes perfect! Try creating your own keys and certificates to get a feel for how PKI works.

Always keep your private keys secure. If they are compromised, your data and communications could be at risk.

Practice Exercises

• Create a key pair and encrypt a message using the public key. Then, decrypt it using the private key.
• Sign a message with your private key and verify it with the public key.
• Create a digital certificate and explore its components.

For further reading, check out the Cryptography Documentation and SSL.com’s PKI FAQ.