>> In the last section,
we talked about TLS and SSL,
and if you happen to jump ahead
>> to this lesson on public key infrastructure
>> without going through that lesson,
I'm going to ask you to go back and listen to it
because these lessons are best understood together.
In that lesson, we talked about SSL and TLS
>> and how they use hybrid cartography method
>> in order to provide encryption services.
>> I also drew a beautiful picture
in PowerPoint that you can see here.
I want to talk about this
>> a little bit more and take it a step further.
>> As we said in the last lesson,
we have a client trying to
reach Bank of America's web server securely
>> and the bank provides its public key.
>> Now if we think about this scenario,
how can the client be sure that what it is receives
is indeed the public key for Bank of America?
Your DNS server would tell you
>> that you have reached Bank of America's web server.
>> But what if the DNS server has been compromised
>> and you are directed to a rogue server
>> and then you send your sensitive information
>> to the rogue server
>> and it's encrypted with the rogue server's public key?
>> How do you get the guarantee
>> that you really are talking to Bank of America?
>> Well, long before Bank of America
>> ever provided online banking,
>> a bank representative would have gone
>> to an organization called a certificate authority.
>> The bank representative would have provided
>> lots of information in business licenses
>> and other documentation to prove
>> that they truly represent the Bank of America
>> and the certificate authority
>> would have given the bank a digital certificate.
>> That digital certificate
>> is exactly what it sounds like.
>> It's an electronic file that's essentially
containing the Bank of America's public key.
How would you know that no one
>> has modified this digital certificate?
>> Well, their certificate authority hashes the file.
How do you know that the certificate authority is
really the one that's issued the digital certificate?
Well, because the certificate authority encrypts
>> the hash with the certificate authority's private key.
>> That way, when the bank's representative
goes back to the bank,
he installs that digital certificate onto the server,
>> and now, when the client connects via HTTPS
>> and requests a secure connection,
>> the bank sends its public key
>> on the digital certificate.
>> That digital certificate needs to be signed
>> by someone that the client trusts.
>> Trust in relationships between certificate authorities
>> means that their client has the certificate of
>> that certificate authority
>> and saw it in the web browser.
>> It's the certificate authority really
>> that makes all this work and
>> the certificate authority is the heart and soul
>> of a public key infrastructure.
>> You may have heard of some certificate authorities.
A well-known one is VeriSign,
but there are many others.