Problem - Kevin Tafuro

Establishing identity
A third use of public key cryptography is in authentication schemes for purposes
of identity establishment (e.g., login). We’ll largely skip this topic for now,
coming back to it in Chapter 8.
In practice, public key cryptography is a complex field with a lot of infrastructure
built around it. Using it effectively requires a trusted third party, which is usually a
public key infrastructure (PKI).
This entire chapter is effective only in the context of some kind of
working PKI, even if it is an ad hoc PKI. Refer to Chapter 10 for PKI
basics.
In this chapter, we’ll describe the fundamentals of key exchange and digital signatures
at a low level. Unfortunately, this area is quite vast, and we’ve had to limit our
discussion to the topics we believe are most relevant to the average developer. We
expect that supplemental recipes for more esoteric topics will gradually become
available on this book’s web site, based on reader contributions.
There are certain interesting topics that we simply don’t have room for in this chapter.
For example, elliptic curve cryptography is a type of public key encryption that
can offer security similar to that of the traditional algorithms presented in this chapter,
with notable speed gains. While elliptic curve cryptography doesn’t speed things
up so much that you would want to use it in places where traditional public key
cryptography isn’t useful, it does allow you to better scale the number of simultaneous
connections you can handle. While elliptic curve cryptography is a fascinating
and useful area, however, it’s not nearly as important as the rest of the material in
this chapter, particularly considering that standards and implementations for this
kind of public key cryptography have emerged only in the last few years, and that the
technology isn’t yet deployed on a wide scale (plus, there are intellectual property
issues when using the standard).
We’ve also limited our examples to OpenSSLwhenever it supports the topic under
discussion. While we do cover Microsoft’s CryptoAPI in several other chapters side
by side with OpenSSL, we won’t be discussing it in this chapter. CryptoAPI’s support
for public key cryptography is sufficiently crippled that providing solutions that
use it would be incomplete to the point of providing you with little or no utility. In
particular, CryptoAPI provides no means to exchange keys in any kind of recognized
portable format (such as DER or PEM; see Recipes 7.16 and 7.17) and no means by
which keys other than randomly generated ones can generate digital signatures.
These limitations effectively rule out a large portion of public key cryptography’s
common uses, which make up the majority of code-related recipes in this chapter.
308 | Chapter 7: Public Key Cryptography
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.