BSCS23160
M. Fasih Ud Din
Case Study 2
Pre Public Key Infrastructure:
1. What is a public key?
A public key is an asymmetric cryptographic key which is shared publicly to encrypt the
data for public key’s owner and verify digital signature of owner (signed by owner’s private
key).
2. What is a private key?
A private key is a secret asymmetric cryptographic key which is kept private to decrypt the
received encrypted data (encrypted using the paired public key which was shared publicly)
and signing the data digitally. It is confidential.
3. What are the key requirements for Public & Private keys?
Private keys are secret and should be kept private. A private key is strictly confidential and
should be stored in a secure storage location i.e. with controlled access. Only the owner
should access, control and use the private key.
Public keys are widely distributed and don’t need security, but they should be
algorithmically linked with the paired private key.
4. Name a commonly used Public/Private Key algorithm?
RSA (Rivest–Shamir–Adleman)
5. Illustrate a single cycle of secure communication between two
people using the algorithm you named in Question 4
Key Generation: Person A generates a key pair (public key, private key) and shares the
public key.
Message Preparation: Person B creates a random symmetric session key and encrypts the
message with that key.
Encrypt Session Key: Person encrypts that randomly created session key with Person A’s
public key shared earlier.
Sign (optional but recommended): Person B computes a hash of the data (or cipher) and
signs the hash with her private key (digital signature).
Sending the package: Person B sends a package to person A. The package contains
encrypted session key, cipher (encrypted by session key), Person B’s signature and
certificate/public key reference.
Receiving the package: Person A receives the package, decrypt the encrypted session key
by his/her private key, decrypt the cipher by the decrypted session key. Person A also
verifies the signature with Person B’s public key.
6. Why is the public key shared openly?
Public keys are shared openly because their function is to encrypt the data by sender and
verify digital signature of the key’s owner. It is necessary to share the public key openly so
anyone can access and use it who wants to send data (encryption) and verify digital
signatures (verification).
It is also nearly impossible to derive a private key paired with shared public key when strong
algorithms are used.
7. What are the challenges faced with using public/private keys,
consider communication directed between two people.
Authenticity / Key Distribution: Ensuring that public key belongs to the right person. MITM
Attacks
Private Key Compromise: If private key is compromised, all security collapses.
Revoking / Expiration: Notifying other users when a key is revoked or expired.
Key Management: Users find key management hard i.e. backups and storing keys in secure
storage locations.
Performance: Asymmetric cryptography is slow.
Algorithm: Future threats like quantum may break / compromise these algorithms and
security measures.
Trusting CAs: It is difficult to decide which CA we should trust.
CA Vulnerabilities: Vulnerabilities in CA is a very main issue.
The intermediary:
1. What is the difference between encryption, hashing and encoding?
Encoding: It is the process of converting data from one form to another for several
purposes. Encoding ensures that data is safely and correctly interpreted by different
systems. No secret keys are used and it is reversible. e.g. Base64 encoding, URL encoding
and character encoding etc.
Hashing: It is an irreversible transformation of input data into a fixed length output known
as hash. Hash is generated by a mathematical function called hash function. Its purpose is
to check the integrity of data because a slight change in original data leads towards an
entirely different hash.
Encryption: It is a process of transferring or converting simple data/plaintext into encrypted
data/ciphertext using a key and algorithm. It ensures the confidentiality of the data. It is
reversible. There are two types of encryption: Symmetric Encryption and Asymmetric
Encryption. e.g. SSL communication, BitLocker encryption and end-to-end messaging etc.
2. What is a digital signature? How is it different from encryption?
A digital signature is a unique cryptographic signature used to verify authenticity, integrity
and non-repudiation of a message or data. A digital signature proves who sent the message
and that it was not altered during transmission. It is just like a handwritten signature but
mathematically secure and verifiable.
Digital signature verifies authenticity and integrity while encryption ensures confidentiality.
Digital signatures use private keys to sign and public keys to verify authenticity, and
encryption uses public keys to encrypt the data and private key to decrypt it. Digital
signatures can be verified by anyone having the respective public keys, but encrypted data
can only be decrypted by the user having private key.
3. Are public and private keys alone sufficient for secure
communication on the internet? Justify your answer.
No, asymmetric encryption is not sufficient alone. It needs additional infrastructure and
policies to be secured.
There should be trustworthy authorities that verify the public keys to avoid MITM attacks
and secure communication. Duration of that verification also matters. Authorities should
regulate rules and policies. Without these authorities, asymmetric encryption is not
enough for secure communication.
Public Key Infrastructure:
1. What is Public Key Infrastructure? How is it different from
public/private key communication from a security perspective?
Public Key Infrastructure is an ecosystem (that includes people, policies, software,
hardware, standards) that provides means to create, manage, distribute, use, store, and
revoke digital certificates and keys. Asymmetric encryption provides functionality to
encrypt and decrypt the data. On the other hand, Public Key Infrastructure adds
identification, root CA certificates, issuing and revoking of certificates and standard
formats and protocols.
2. What are the main components of PKI?
CA (Certificate Authority): Issues and signs certificates. (Root of Trust)
RA (Registration Authority): Ensures identification for certificate issuance.
Certificates: Signed documents used to identify or verify public keys.
CRL (Certificate Revocation List): List of revoked certificates.
OCSP (Online Certificate Status Protocol): Checks the status of a digital certificate online.
3. What is a digital certificate? What information does it typically
contain?
A digital certificate is a file issued by CA that identifies an entity. (Public Key of Entity)
A digital certificate typically contains:
Subject Name: A unique name that identifies certificate holder.
Public Key: The owner’s public key, which is part of the cryptographic key pair used to
encrypt messages and verify digital signature.
Issuer’s name: The name of the CA that issued the certificate.
Issuer’s Digital Signature: The CA’s signature created by its private key.
Serial Number: A unique number of certificates.
Validity Period: Valid from and valid till.
4. What is a CA (certificate authority)? Briefly explain its role in PKI.
A CA identifies the binding of public key to entity and signs the digital certificate for it.
Verifies requests (via RA)
Issues/signs certificates
Maintains and publishes CRLs/OCSP for revocation
Publishes policies and comply with audits (for public CAs)
5. Explain the hierarchy in PKI? Why do we need this hierarchy?
Root CA (self-signed)
Intermediate CAs
Entity
We need a hierarchy because a single CA cannot manage such large number of entities.
Intermediate CAs should also be verified by some higher authority.
6. What is a Certificate Lifecycle? List its main stages.
Key generation
CSR (Certificate Signing Request) creation.
Registration/Validation by RA/CA
Issuance (CA signs and issues certificate).
Monitoring (expiry, mis issuance).
Renewal / Reissue
Revocation
Expiration / archival
7. Is a revoked certificate different from invalid certificate? If not,
why?
Yes, it is different from invalid certificate. A revoked certificate is declared invalid by CA
before its expiration. (Listed in CRL)
Invalid Certificate is broader term and there could be many reasons for a certificate to be
invalid.
8. Which authority can revoke a certificate? What are the criteria for
revocation?
CA can revoke a certificate.
Criteria:
Private Key Compromise
CA Compromise
Cease of use
Mis Issuance
9. Give a real-life example of PKI you are using in your daily life. Briefly
explain how it is being used.
HTTPS (Web Browsing)
The server presents certificate chain.
Your browser checks the chain up to a trusted root in its trust store, verifies signatures,
checks validity dates, and checks the OCSP/CRL.