{"id":5614,"date":"2015-05-06T17:21:57","date_gmt":"2015-05-06T16:21:57","guid":{"rendered":"http:\/\/www.markwilson.co.uk\/blog\/?p=5614"},"modified":"2015-05-06T17:21:57","modified_gmt":"2015-05-06T16:21:57","slug":"public-key-infrastructure-explained","status":"publish","type":"post","link":"https:\/\/www.markwilson.co.uk\/blog\/2015\/05\/public-key-infrastructure-explained.htm","title":{"rendered":"Public key infrastructure explained"},"content":{"rendered":"

Last week, I was attending a presentation skills course where we had to give an impromptu presentation (well, we had an hour to prepare) on a topic of our choice. \u00a0One of my colleagues, Richard Butler, gave his talk on public key infrastructure (PKI) and Richard was the first person who\u00a0has explained PKI to me in a way that made me go “ah! got it!” because he used a great analogy.<\/p>\n

So, I’m going to attempt to repeat it here (with Richard’s permission)… and hopefully I’ll get it right!<\/p>\n

Richard’s first point was that PKI is thought of as a security tool, some technology, or something that’s needed to make the network secure. Actually, he suggests, there’s more to it than that…<\/p>\n

The first example Richard gives is one of\u00a0a server certificate (used to ensure that a service can be trusted and that confidentiality is maintained),\u00a0illustrated by way of border control.<\/p>\n

An airline\u00a0passenger\u00a0approaches a border (e.g. an immigration desk at the airport):<\/p>\n

    \n
  1. The border\u00a0is where the passenger\u00a0expects it to be.<\/li>\n
  2. A border guard wears a uniform, with an insignia (badge).<\/li>\n
  3. The passenger\u00a0recognises the insignia and trusts it as genuine.<\/li>\n
  4. The passenger interacts with the border guard to negotiate entry to the country.<\/li>\n<\/ol>\n

    A server certificate is similar because it’s presented to\u00a0prove that the server is who they say they are and is trusted by users\u00a0accessing its services. The certificate is issued by a certificate authority, just as the border guard’s badge\u00a0is issued by a government agency.<\/p>\n

    In Richard’s second example, a certificate is used to provide confidence that you are who you say you are, a process known as integrity or repudiation.<\/p>\n

      \n
    1. As a citizen of a country, I request a passport from my\u00a0government.<\/li>\n
    2. The\u00a0government validates my request.<\/li>\n
    3. If my request is valid, a passport is issued.<\/li>\n
    4. When visiting a foreign country, I present my passport at the border.<\/li>\n
    5. The government of the foreign country trusts the government that issued the password to have carried out the necessary background checks that confirm I am who I say I am.<\/li>\n
    6. I’m authorised\u00a0to enter the country.<\/li>\n<\/ol>\n

      In this case:<\/p>\n