Public Key Infrastructure (PKI) relies on a branch of Cryptography more popularly known as Public Key Cryptography. Public Key Cryptography uses a Key-Pair to encrypt and decrypt data. The key-pair is mathematically related to each other where one key in the key-pair is called a private key and the other key is called the public key. The underlying concept of security relies on the fact that the private key will be kept secured and will never be shared whereas the public key will be shared with others.
Trusted and Secure Communication
In the world of computers, any parties intending to communicate with each other must have their own individual key-pairs. Let’s assume there are two persons intending to communicate with each other, Batman and Alfred. Both have their own individual key-pairs. While sending a message to Alfred, Batman will use Alfred’s public key to encrypt the message so that only Alfred can open such message using his private key. How will Alfred know the message actually originated from Batman? Simple, Batman will sign the message with his private key and Alfred can verify the signature of message using Batman’s public key.
So far so good for allowing communications between Batman and Alfred. However in the real world of computing with massively online communications, how does one system actually trust another system? How can one be sure that Batman is actually Batman and not The Joker posing as Batman? I.e. how will Alfred trust Batman’s public key and vice-versa?
Identity Authority in Real World
Let’s take a look at how a person in real world obtains an identity that is publicly trusted. Drivers’ License is issued by a state’s transport authority however it is acceptable form of identity document across entire nation (and in many cases across many nations.) A person intending to procure a drivers’ license has to first identify himself/herself without ambiguity to the transport authority. Transport authority may employ additional means to validate such identity like requesting additional documentation to support the identity claim. In places where a drivers’ license also serves as a proof of residence (or proof of address), the transport authority may employ mechanism for personal visit to place of residence to ensure the authenticity of such residential (address) claim.
Transport authority takes this pain to establish the claim of identity so that once it stamps such a drivers’ license, other parties in the world can safely rely on the identity data contained within the drivers’ license. I.e. the world can trust the publicly visible details on the drivers’ license and further trust that holder of such license must have procured the license via genuine means.
Certificate Authority
In the online world, much like the offline world, there are authorities that have earned trust and in general can be relied upon to provide authentic identification. These authorities are termed as Trusted Root or Certificate Authority. Different OS and browser manufacturers run their individual Trusted Root programmes through which they audit and certify interested organizations on their process and security measures pertaining to issue of public certificates. These trusted roots are then included in the respective OS or browser and any certificates issued by such root to end-users or servers is automatically trusted by the OS or browser.
Certificate Authority Hierarchy
The weakest link in the chain is Root Certificate, the top level certificate that is validated and trusted by OS’s and browsers. If anybody breaches the security of a Trusted Root/Certificate Authority and misuses its root certificate, there will be havoc in the online world. To prevent such mishap and in turn improve the security of Trusted Root, the root certificate is kept offline and stringent measures are put in place to restrict access to the root certificate. Hundreds of certificate requests are verified and processed each day to keep the online world running securely. This is made possible by creating a Certificate Authority Hierarchy.
Trusted Root/Certificate Authority creates a second level of Certificate Authority a.k.a. Intermediate Certificate Authority that is kept online for the express purpose of issuing certificates. There are adequate safe-guards in place to ensure safety and security of such Intermediate Certificate Authorities as well. However, a breach to an Intermediate Certificate Authority will not compromise the Trusted Root. It would compromise only those sub-set of certificates that were issued by such Intermediate Certificate Authority that would need to be revoked and reissued.
The Public Key Infrastructure employing Certificate Authority hierarchy has been effectively safe-guarding all of us since 1995, a time when the internet was taking off. Thanks to it, we can securely communicate online without the fear of any eavesdropper or nasty big-brother with ill intentions.