Problem - Kevin Tafuro

The code presented in this chapter should otherwise translate easily to most other
functionally complete libraries. Again, in situations where this is not the case, we
expect that reader contributions will eventually mend this problem.
We expect that for most purposes, the general-purpose networking
recipes provided in Chapter 9 are likely to be more applicable to the
average developer. Unless you really know what you’re doing, there is
significant risk of needing a prosthetic foot when using this chapter.
7.1 Determining When to Use Public Key
Cryptography
Problem
You want to know when to use public key cryptography as opposed to symmetric
cryptography.
Solution
Use public key cryptography only for key exchange or digital signatures. Otherwise,
there are a lot of disadvantages and things that can go wrong (particularly when
using it for general-purpose encryption). Because public key operations are computationally
expensive, limit digital signatures to authentication at connection time and
when you need non-repudiation.
Discussion
Whenever you use public key encryption, be sure to remember also to
perform proper authentication and message integrity checking.
Public key cryptography allows parties to communicate securely without having to
establish a key through a secure channel in advance of communication, as long as a
trusted third party is involved. Therein lies the first rub. Generally, if you use public
key cryptography, you need to determine explicitly with whom you’re communicating,
and you need to check with a trusted third party in a secure manner. To do that,
you will need to have identification data that is bound to your trusted third party,
which you’ll probably need to authenticate over some secure channel.
Figure 7-1 (A) illustrates why public key cryptography on its own does not provide
secure communication. Suppose the server has a {public key, private key} pair, and
the client wishes to communicate with the server. If the client hasn’t already securely
Determining When to Use Public Key Cryptography | 309
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.