Problem - Kevin Tafuro

Chapter CHAPTER 10 10
Public Key Infrastructure
In Recipe 7.1, we described an attack known as a man-in-the-middle attack, in which
an attacker could intercept and even manipulate communications secured with public
key cryptography. The attack is possible because public key cryptography provides
no means of establishing trust when used on its own. Public key infrastructure
(PKI) provides the means to establish trust by binding public keys and identities,
thus giving reasonable assurance that we are communicating securely with whom we
think we are.
In the real world, we often have no way of knowing firsthand who a public key
belongs to, and that is a big problem. Unfortunately, there is no sure-fire way to
know that we are communicating with whom we think we are. The best we can do is
extend our trust to a third party to certify that a public key belongs to the party that
is claiming ownership of it. That is where PKI fits in.
PKI is important to using public key cryptography effectively and is essential to
understanding and using the SSLprotocol. The recipes in this chapter provide an
overview of PKI and how to use it effectively with both OpenSSL and CryptoAPI.
10.1 Understanding Public Key Infrastructure (PKI)
Problem
You want a fundamental understanding of PKI.
Solution
Read the following discussion for an overview of basic PKI concepts. For a more
detailed treatment, we recommend the book Planning for PKI: Best Practices Guide
for Deploying Public Key Infrastructure by Russ Housley and Tim Polk (John Wiley
& Sons).
502
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.