In this lesson,
we're going to cover public key infrastructure,
also known as PKI.
Now, public key infrastructure, or PKI,
is an entire system of hardware, software, policies,
procedures, and people
that is based on asymmetric encryption.
If you've ever connected to a website
using an HTTPS connection,
you've already been part of the public key infrastructure.
Now, if you want to establish a secure connection
to a website, like diontraining.com,
you would go into your web browser
and type in https://www.diontraining.com.
Your web browser will then go to a trusted third party
called the certificate authority
and they're going to ask them for a copy
of my web server's public key.
Then your web browser
will pick a long random string of numbers
and it's going to use that as a shared secret key
to you use with a symmetric algorithm for bulk encryption,
something like AES as we start transferring data back
and forth between your web browser and my web server.
But first, you have to get
that randomly chosen shared secret key
over to my web server securely
and for that, we're actually going to use public key encryption
known as asymmetrical encryption.
Now, using my public key
that you downloaded from the certificate authority,
your computer will then encrypt
that random shared secret key
that you just randomly created.
Now, in the example here,
I'm going to use a short number like 51363
as our shared secret.
Now, once you encrypt that using my servers public key,
which anyone in the world has access to,
you can then send it over the internet to my web server.
Now, because it's encrypted with my public key though,
no one on the internet is going to be able to decrypt it
unless they have my private key
and the only person
who has that private key is my web server.
So as we go across the internet, no one can see the fact
that we are going to use 51363 as our shared secret code.
Now, once my web server receives that encrypted cipher text,
it's going to use my server's private key to decrypt it
and then get it back to that shared secret key
that you submitted.
Now, I can read the plain text
and I know the number is 51363.
So far, this is all using asymmetrical encryption
like we discussed before.
Now up to this point,
everything we've done has to do with asymmetric encryption,
but now that both you
and my web server know the shared secret key,
we can switch over and create a symmetric tunnel.
Now, to do this, we're going to use something like AES
to create a TLS or SSL tunnel over the internet
and then communicate safely
and securely through that tunnel
to make sure nobody can see the data you're entering in,
like your credit card number,
if you're trying to buy an exam voucher.
Now, this is going to be able to ensure
that we have confidentiality
because only we have access to this shared tunnel
because we both have that shared secret key
and because my web server is the only device
in the entire world that has its private key,
you can be assured
that only my web server knows who it is
and who it claims to be when you sent that code over.
This way, we now have authentication.
You know it's diontraining.com.
This gives us the identity of my server
and it also lets your web browser know it can trust me.
Now, if all that occurs successfully,
you're going to get that little padlock in your browser
showing that we both can communicate securely
with each other over this encrypted tunnel.
Now, PKI and public cryptography are closely related,
but they are not the same thing.
When we talk about PKI, this is the system
that creates the asymmetrical key pairs
that consists of those public and private keys
that are going to be used in the encryption
and decryption process, as well as managing those key pairs
to make sure they're valid and can be trusted.
When we talk about public key cryptography
on the other hand, we're just talking about the encryption
and decryption process and this encryption
and decryption process,
it's just one small part of the overall PKI architecture.
Now, for all of this, to work successfully,
you need to have a trusted third party involved.
This trusted third party
is known as a certificate authority.
These certificate authorities
are going to issue digital certificates
and these certificate authorities
are also going to keep the level of trust
between all the certificate authorities
around the world intact.
Another essential component
of the PKI system is what's known as key escrow.
Now, key escrow refers to the process
where cryptographic keys are going to be stored
in a secure third party location,
which is effectively called an escrow.
In the event that an organization
or individual loses access to their encryption keys,
or in cases of legal investigations,
these keys can be retrieved from that escrow account.
This ensures that the encrypted data
will never be completely inaccessible to us.
Now, in the context of PKI,
key escrow can be particularly relevant.
Let's consider a situation
where an employee encrypts sensitive documents
using their personal PKI certificates
and then unexpectedly leaves the company
or loses their private key.
Without a means to decrypt these documents,
the organization would be at a significant loss.
However, if the encryption keys were stored in a key escrow,
the organization could retrieve them
and then access the encrypted information.
Now, while a key escrow can be very beneficial,
it is not without its controversies.
The primary concern here is going to be security
because if a malicious actor can gain access
to those escrow keys,
they can potentially decrypt vast amounts of data.
As a result, the storage
and management of keys in an escrow
must be incredibly secure
and access to those keys should be strongly regulated.
Now, remember, the public key infrastructure
or PKI is a framework for managing digital keys
and certificates that facilitate secure data transfer,
authentication, and encrypted communications
over our networks.
PKI uses public key cryptography to do all of its functions,
but the PKI system itself is an entire system
that is going to be used to be able
to create a secure connection from end-to-end.
Now, if we're talking about the public key encryption,
we're just talking about the asymmetric encryption
and decryption portion of this process,
but when we talk about PKI,
we are talking about everything together.
Now, PKI is pivotal to ensure the secure communication
and data exchange that happens on the internet
and components like key escrow are going to provide us
with additional layers of flexibility and assurance,
but they also introduce their own sets of challenges
that we must manage effectively to ensure the security
of our enterprise networks.