1 00:00:00,090 --> 00:00:01,650 In this lesson, we're going to cover 2 00:00:01,650 --> 00:00:05,310 public key infrastructure, also known as PKI. 3 00:00:05,310 --> 00:00:08,760 Now, public key infrastructure or PKI is an entire system 4 00:00:08,760 --> 00:00:11,490 of hardware, software, policies, procedures 5 00:00:11,490 --> 00:00:14,490 and people that is based on asymmetric encryption. 6 00:00:14,490 --> 00:00:15,420 If you've ever connected 7 00:00:15,420 --> 00:00:17,970 to a website using an HTTPS connection, 8 00:00:17,970 --> 00:00:21,030 you've already been part of the public key infrastructure. 9 00:00:21,030 --> 00:00:23,550 Now, if you want to establish a secure connection to a website 10 00:00:23,550 --> 00:00:26,580 like diontraining.com, you would go into your web browser 11 00:00:26,580 --> 00:00:30,067 and type in https://www.diontraining.com. 12 00:00:32,729 --> 00:00:34,080 Your web browser will then go 13 00:00:34,080 --> 00:00:36,840 to a trusted third party call the certificate authority 14 00:00:36,840 --> 00:00:37,673 and they're going to ask them 15 00:00:37,673 --> 00:00:40,080 for a copy of my web server's public key. 16 00:00:40,080 --> 00:00:42,725 Then your web browser will pick a long random string 17 00:00:42,725 --> 00:00:46,080 of numbers, and it's going to use that as a shared secret key. 18 00:00:46,080 --> 00:00:49,080 So you use with a symmetric algorithm for bulk encryption 19 00:00:49,080 --> 00:00:51,630 something like AES as we start transferring data back 20 00:00:51,630 --> 00:00:54,570 and forth between your web browser and my web server. 21 00:00:54,570 --> 00:00:55,830 But first, you have to get 22 00:00:55,830 --> 00:00:58,200 that randomly chosen shared secret key over 23 00:00:58,200 --> 00:00:59,850 to my web server securely. 24 00:00:59,850 --> 00:01:00,683 And for that, 25 00:01:00,683 --> 00:01:02,700 we're actually going to use public key encryption, 26 00:01:02,700 --> 00:01:05,010 known as asymmetrical encryption. 27 00:01:05,010 --> 00:01:07,140 Now, using my public key that you downloaded 28 00:01:07,140 --> 00:01:08,985 from the certificate authority, your computer 29 00:01:08,985 --> 00:01:11,310 will then encrypt that random shared secret key 30 00:01:11,310 --> 00:01:13,200 that you just randomly created. 31 00:01:13,200 --> 00:01:15,510 Now, in the example here, I'm going to use a short number 32 00:01:15,510 --> 00:01:18,990 like 51363 as our shared secret. 33 00:01:18,990 --> 00:01:21,840 Now, once you encrypt that using my server's public key, 34 00:01:21,840 --> 00:01:23,940 which anyone in the world has access to, 35 00:01:23,940 --> 00:01:26,940 you can then send it over the internet to my web server. 36 00:01:26,940 --> 00:01:29,074 Now, because it's encrypted with my public key though, 37 00:01:29,074 --> 00:01:30,602 no one on the internet is going to be able to 38 00:01:30,602 --> 00:01:34,050 decrypt it unless they have my private key, 39 00:01:34,050 --> 00:01:35,970 and the only person who has that private key 40 00:01:35,970 --> 00:01:37,380 is my web server. 41 00:01:37,380 --> 00:01:40,680 So as we go across the internet, no one can see the fact 42 00:01:40,680 --> 00:01:44,486 that we are going to use 51363 as our shared secret code. 43 00:01:44,486 --> 00:01:47,970 Now, once my web server receives that encrypted cipher text, 44 00:01:47,970 --> 00:01:50,580 it's going to use my server's private key to decrypt it 45 00:01:50,580 --> 00:01:51,450 and then get it back 46 00:01:51,450 --> 00:01:53,820 to that shared secret key that you submitted. 47 00:01:53,820 --> 00:01:55,680 Now I can read the plain text 48 00:01:55,680 --> 00:01:58,680 and I know the number is 51363. 49 00:01:58,680 --> 00:02:01,710 So far, this is all using asymmetrical encryption 50 00:02:01,710 --> 00:02:03,540 like we discussed before. 51 00:02:03,540 --> 00:02:05,565 Now, up to this point, everything we've done has to do 52 00:02:05,565 --> 00:02:08,759 with asymmetric encryption, but now that both you 53 00:02:08,759 --> 00:02:11,340 and my web server know the shared secret key, 54 00:02:11,340 --> 00:02:14,160 we can switch over and create a symmetric tunnel. 55 00:02:14,160 --> 00:02:15,690 Now, to do this, we're going to use something 56 00:02:15,690 --> 00:02:18,810 like AES to create a TLS or SSL tunnel 57 00:02:18,810 --> 00:02:21,810 over the internet, and then communicate safely and securely 58 00:02:21,810 --> 00:02:23,970 through that tunnel to make sure nobody can see 59 00:02:23,970 --> 00:02:26,550 the data you're entering in like your credit card number 60 00:02:26,550 --> 00:02:28,740 if you're trying to buy an exam voucher. 61 00:02:28,740 --> 00:02:30,780 Now, this is going to be able to ensure that we have 62 00:02:30,780 --> 00:02:33,570 confidentiality because only we have access 63 00:02:33,570 --> 00:02:36,000 to this shared tunnel because we both have that 64 00:02:36,000 --> 00:02:37,380 shared secret key. 65 00:02:37,380 --> 00:02:39,510 And because my web server is the only device 66 00:02:39,510 --> 00:02:41,571 in the entire world that has its private key, 67 00:02:41,571 --> 00:02:45,750 you can be assured that only my web server knows who it is 68 00:02:45,750 --> 00:02:48,900 and who it claims to be when you sent that code over. 69 00:02:48,900 --> 00:02:50,730 This way, we now have authentication. 70 00:02:50,730 --> 00:02:52,830 You know it's diontraining.com. 71 00:02:52,830 --> 00:02:55,290 This gives us the identity of my server, and it also 72 00:02:55,290 --> 00:02:57,660 lets your web browser know it can trust me. 73 00:02:57,660 --> 00:02:59,520 Now, if all that occurs successfully, 74 00:02:59,520 --> 00:03:02,280 you're going to get that little padlock in your browser showing 75 00:03:02,280 --> 00:03:04,530 that we both can communicate securely with each other 76 00:03:04,530 --> 00:03:06,300 over this encrypted tunnel. 77 00:03:06,300 --> 00:03:09,390 Now, I know that sounds a lot like public key cryptography. 78 00:03:09,390 --> 00:03:11,940 Well, it kind of is because PKI 79 00:03:11,940 --> 00:03:14,580 and public key cryptography are closely related, 80 00:03:14,580 --> 00:03:16,770 but they are not the same thing. 81 00:03:16,770 --> 00:03:18,480 When we talk about PKI, 82 00:03:18,480 --> 00:03:21,540 this is the system that creates the asymmetrical key pairs 83 00:03:21,540 --> 00:03:23,730 that consists of those public and private keys 84 00:03:23,730 --> 00:03:25,290 that are going to be used in the encryption 85 00:03:25,290 --> 00:03:28,200 and decryption process, as well as managing those key pairs 86 00:03:28,200 --> 00:03:30,660 to make sure they're valid and can be trusted. 87 00:03:30,660 --> 00:03:32,430 When we talk about public key cryptography 88 00:03:32,430 --> 00:03:34,290 on the other hand, we're just talking about 89 00:03:34,290 --> 00:03:36,480 the encryption and decryption process. 90 00:03:36,480 --> 00:03:38,400 And this encryption and decryption process 91 00:03:38,400 --> 00:03:42,390 is just one small part of the overall PKI architecture. 92 00:03:42,390 --> 00:03:44,790 Now, for all of this to work successfully, you need to 93 00:03:44,790 --> 00:03:46,773 have a trusted third party involved. 94 00:03:47,846 --> 00:03:48,810 This trusted third party is known 95 00:03:48,810 --> 00:03:50,490 as a certificate authority. 96 00:03:50,490 --> 00:03:51,690 These certificate authorities 97 00:03:51,690 --> 00:03:53,400 are going to issue digital certificates 98 00:03:53,400 --> 00:03:55,050 and these certificate authorities are also 99 00:03:55,050 --> 00:03:56,190 going to keep the level of trust 100 00:03:56,190 --> 00:03:57,870 between all the certificate authorities 101 00:03:57,870 --> 00:03:59,940 around the world intact. 102 00:03:59,940 --> 00:04:01,200 Another essential component of 103 00:04:01,200 --> 00:04:04,290 the PKI system is what's known as key escrow. 104 00:04:04,290 --> 00:04:06,180 Now, key escrow refers to the process 105 00:04:06,180 --> 00:04:07,620 where cryptographic keys are going to 106 00:04:07,620 --> 00:04:10,110 be stored in a secure, third party location, 107 00:04:10,110 --> 00:04:12,510 which is effectively called an escrow. 108 00:04:12,510 --> 00:04:14,550 In the event that an organization or individual 109 00:04:14,550 --> 00:04:16,470 loses access to their encryption keys, 110 00:04:16,470 --> 00:04:18,839 or in cases of legal investigations, 111 00:04:18,839 --> 00:04:21,839 these keys can be retrieved from that escrow account. 112 00:04:21,839 --> 00:04:23,340 This ensures that the encrypted data 113 00:04:23,340 --> 00:04:26,040 will never be completely inaccessible to us. 114 00:04:26,040 --> 00:04:27,930 Now, in the context of PKI, 115 00:04:27,930 --> 00:04:30,360 key escrow can be particularly relevant. 116 00:04:30,360 --> 00:04:32,100 Let's consider a situation where an employee 117 00:04:32,100 --> 00:04:34,830 encrypts sensitive documents using their personal PKI 118 00:04:34,830 --> 00:04:37,500 certificates and then unexpectedly leaves the company 119 00:04:37,500 --> 00:04:39,510 or loses their private key. 120 00:04:39,510 --> 00:04:41,490 Without a means to decrypt these documents, 121 00:04:41,490 --> 00:04:44,130 the organization would be at a significant loss. 122 00:04:44,130 --> 00:04:47,400 However, if the encryption keys were stored in a key escrow, 123 00:04:47,400 --> 00:04:48,930 the organization could retrieve them 124 00:04:48,930 --> 00:04:51,450 and then access the encrypted information. 125 00:04:51,450 --> 00:04:54,000 Now, while key escrow can be very beneficial, 126 00:04:54,000 --> 00:04:56,100 it is not without its controversies. 127 00:04:56,100 --> 00:04:58,500 The primary concern here is going to be security, 128 00:04:58,500 --> 00:05:00,540 because if a malicious actor can gain access 129 00:05:00,540 --> 00:05:01,800 to those escrow keys, 130 00:05:01,800 --> 00:05:04,590 they can potentially decrypt vast amounts of data. 131 00:05:04,590 --> 00:05:06,840 As a result, the storage and management of keys 132 00:05:06,840 --> 00:05:10,110 in an escrow must be incredibly secure, and access 133 00:05:10,110 --> 00:05:12,750 to those keys should be strongly regulated. 134 00:05:12,750 --> 00:05:14,940 Now, remember, the public key infrastructure 135 00:05:14,940 --> 00:05:17,640 or PKI is a framework for managing digital keys 136 00:05:17,640 --> 00:05:20,321 and certificates that facilitates secure data transfer 137 00:05:20,321 --> 00:05:22,710 authentication, and encrypted communications 138 00:05:22,710 --> 00:05:24,090 over our networks. 139 00:05:24,090 --> 00:05:26,670 PKI uses public key cryptography to do all 140 00:05:26,670 --> 00:05:29,310 of its functions, but the PKI system itself 141 00:05:29,310 --> 00:05:31,710 is an entire system that is going to be used to 142 00:05:31,710 --> 00:05:34,620 be able to create a secure connection from end-to-end. 143 00:05:34,620 --> 00:05:36,870 Now, if we're talking about the public key encryption, 144 00:05:36,870 --> 00:05:39,090 we're just talking about the asymmetric encryption 145 00:05:39,090 --> 00:05:41,580 and decryption portion of this process. 146 00:05:41,580 --> 00:05:43,017 But when we talk about PKI, 147 00:05:43,017 --> 00:05:45,720 we are talking about everything together. 148 00:05:45,720 --> 00:05:48,720 Now, PKI is pivotal to ensure the secure communication 149 00:05:48,720 --> 00:05:50,970 and data exchange that happens on the internet 150 00:05:50,970 --> 00:05:53,070 and components like key escrow are going to provide us 151 00:05:53,070 --> 00:05:55,350 with additional layers of flexibility and assurance, 152 00:05:55,350 --> 00:05:57,090 but they also introduce their own sets 153 00:05:57,090 --> 00:05:59,130 of challenges that we must manage effectively 154 00:05:59,130 --> 00:06:01,630 to ensure the security of our enterprise networks.