Welcome to the module entitled public key infrastructure which discusses how to implement the principle
of trust but control.
First of all let's think about public infrastructure from the functional perspective.
Let's assume that we are the person on the left side of the picture above for some reason we have to
consult a doctor.
The first thing we need to do before we follow this doctor's instructions and advise is consider whether
this is actually a person whom we should trust.
How do we verify this.
The problem is that we don't know them personally in business life and in particular in the virtual
world of the Internet we often have to trust sometimes in important matters.
People who have never seen with our own eyes people whom we don't know how can we build a relationship
of trust.
Maybe we need to take someone at their word.
I'm the best.
And in addition I have good intentions.
If not me then who can you trust.
If we're skeptical to such an approach we may ask a person to prove it.
What can this person do at this point.
Maybe he can show a diploma from a reputable university.
What questions should now appear in our mind.
Is this a school that we can trust.
A person who we don't know a doctor tries to prove to us his identity by showing us a document issued
by some organization.
If the document is the original and is not falsified in any way then for this relationship of trust
to make sense the organization issuing the diploma must be on a list of organizations that we already
trust we trust that the school produces talented graduates.
If this is the case and the given person is a graduate from this school we trust that person a relationship
of trust based on certificates is built this way certificates confirm the identity of system users.
However in order to trust the certificate we must trust the certification authority who issued it.
This is the starting point.
How does it work in practice.
How do we implement the comic shown in a computer system.
We need a few things.
First we need certification authorities meaning services that will issue certificates to authorized
users.
We assume that the procedure for issuing certificates will be in accordance with our expectations.
The basic error is also that we trust all certificates in the same way some certification authorities
are more reliable than others.
Secondly we need the certificates themselves their digital identity cards.
This may be something like in the previous picture a lemonade a diploma with the seal of a given university
in order to be certain that it is the school which issued it.
However we do not use laminated pieces of paper and computer systems we use data in digital form exactly
the same principle applies to a digital certificate a digital certificate will be evidence of somebodies
identity.
Issued by someone else and signed by them this someone will be the certification authority the use of
certificates is strictly defined.
If we visit a doctor and he showed us a diploma from a technical university it wouldn't necessarily
arouse our confidence regarding his competence in the field of medicine.
We would know that he actually is.
For example John Smith.
And that is a great electronic engineer.
But this doesn't translate into his capacity to perform open heart surgery.
The same is true with certificates a certificate has a specific purpose and its purpose is clearly defined
and recorded in the certificate.
In practice to issue certificates the certification authority must have some sort of template on the
basis of the template.
It will issue the certificates somehow.
We need to receive the certificate
we need to have a certificate distribution point.
We need to know where to go to get the certificate all the more in computer systems because very often
we will request such certificates automatically in one of the past modules.
We had the opportunity to discuss the topic of encrypted file systems.
FS there are also we use a certificate an application or a request to issue a certificate was sent automatically.
Let's return to the earlier analogy of the patient and the doctor even if the doctor had a certificate
from a medical university and we trusted the school we should still check.
One more thing.
We should check whether or not this certificate is still valid whether or not for some reason that person
has not lost his competence for example whether or not the university revoked the certificate.
In the case of a university diploma this really happens.
But in the computing environment certificate relocation is not so rare.
We should still have some tools to manage the entire infrastructure in an effective and efficient manner.
Meaning all the points which will be talked about.