In this lesson, we're going to cover
public key infrastructure, also known as PKI.
Now, public key infrastructure or PKI is an entire system
of hardware, software, policies, procedures
and people that is based on asymmetric encryption.
If you've ever connected
to a website using an HTTPS connection,
you've already been part of the public key infrastructure.
Now, if you want to establish a secure connection to a website
like diontraining.com, you would go into your web browser
and type in https://www.diontraining.com.
Your web browser will then go
to a trusted third party call the certificate authority
and they're going to ask them
for a copy of my web server's public key.
Then your web browser will pick a long random string
of numbers, and it's going to use that as a shared secret key.
So you use with a symmetric algorithm for bulk encryption
something like AES as we start transferring data back
and forth between your web browser and my web server.
But first, you have to get
that randomly chosen shared secret key over
to my web server securely.
And for that,
we're actually going to use public key encryption,
known as asymmetrical encryption.
Now, using my public key that you downloaded
from the certificate authority, your computer
will then encrypt that random shared secret key
that you just randomly created.
Now, in the example here, I'm going to use a short number
like 51363 as our shared secret.
Now, once you encrypt that using my server's public key,
which anyone in the world has access to,
you can then send it over the internet to my web server.
Now, because it's encrypted with my public key though,
no one on the internet is going to be able to
decrypt it unless they have my private key,
and the only person who has that private key
is my web server.
So as we go across the internet, no one can see the fact
that we are going to use 51363 as our shared secret code.
Now, once my web server receives that encrypted cipher text,
it's going to use my server's private key to decrypt it
and then get it back
to that shared secret key that you submitted.
Now I can read the plain text
and I know the number is 51363.
So far, this is all using asymmetrical encryption
like we discussed before.
Now, up to this point, everything we've done has to do
with asymmetric encryption, but now that both you
and my web server know the shared secret key,
we can switch over and create a symmetric tunnel.
Now, to do this, we're going to use something
like AES to create a TLS or SSL tunnel
over the internet, and then communicate safely and securely
through that tunnel to make sure nobody can see
the data you're entering in like your credit card number
if you're trying to buy an exam voucher.
Now, this is going to be able to ensure that we have
confidentiality because only we have access
to this shared tunnel because we both have that
shared secret key.
And because my web server is the only device
in the entire world that has its private key,
you can be assured that only my web server knows who it is
and who it claims to be when you sent that code over.
This way, we now have authentication.
You know it's diontraining.com.
This gives us the identity of my server, and it also
lets your web browser know it can trust me.
Now, if all that occurs successfully,
you're going to get that little padlock in your browser showing
that we both can communicate securely with each other
over this encrypted tunnel.
Now, I know that sounds a lot like public key cryptography.
Well, it kind of is because PKI
and public key cryptography are closely related,
but they are not the same thing.
When we talk about PKI,
this is the system that creates the asymmetrical key pairs
that consists of those public and private keys
that are going to be used in the encryption
and decryption process, as well as managing those key pairs
to make sure they're valid and can be trusted.
When we talk about public key cryptography
on the other hand, we're just talking about
the encryption and decryption process.
And this encryption and decryption process
is just one small part of the overall PKI architecture.
Now, for all of this to work successfully, you need to
have a trusted third party involved.
This trusted third party is known
as a certificate authority.
These certificate authorities
are going to issue digital certificates
and these certificate authorities are also
going to keep the level of trust
between all the certificate authorities
around the world intact.
Another essential component of
the PKI system is what's known as key escrow.
Now, key escrow refers to the process
where cryptographic keys are going to
be stored in a secure, third party location,
which is effectively called an escrow.
In the event that an organization or individual
loses access to their encryption keys,
or in cases of legal investigations,
these keys can be retrieved from that escrow account.
This ensures that the encrypted data
will never be completely inaccessible to us.
Now, in the context of PKI,
key escrow can be particularly relevant.
Let's consider a situation where an employee
encrypts sensitive documents using their personal PKI
certificates and then unexpectedly leaves the company
or loses their private key.
Without a means to decrypt these documents,
the organization would be at a significant loss.
However, if the encryption keys were stored in a key escrow,
the organization could retrieve them
and then access the encrypted information.
Now, while key escrow can be very beneficial,
it is not without its controversies.
The primary concern here is going to be security,
because if a malicious actor can gain access
to those escrow keys,
they can potentially decrypt vast amounts of data.
As a result, the storage and management of keys
in an escrow must be incredibly secure, and access
to those keys should be strongly regulated.
Now, remember, the public key infrastructure
or PKI is a framework for managing digital keys
and certificates that facilitates secure data transfer
authentication, and encrypted communications
over our networks.
PKI uses public key cryptography to do all
of its functions, but the PKI system itself
is an entire system that is going to be used to
be able to create a secure connection from end-to-end.
Now, if we're talking about the public key encryption,
we're just talking about the asymmetric encryption
and decryption portion of this process.
But when we talk about PKI,
we are talking about everything together.
Now, PKI is pivotal to ensure the secure communication
and data exchange that happens on the internet
and components like key escrow are going to provide us
with additional layers of flexibility and assurance,
but they also introduce their own sets
of challenges that we must manage effectively
to ensure the security of our enterprise networks.