The key distribution problem is the challenge of delivering cryptographic keys to authorized parties without exposing them to attackers. With symmetric encryption, every communicating service needs the same secret key, so administrators must copy and protect that key in each application. As the number of services grows, configuration, rotation, and compromise become difficult to control. section 6.1
ACME refund services
ACME’s warehouse service approves refunds and writes them to a daily file for the payment service. Accounting, inventory, and marketing services also need the refund data. If all services share an AES key stored in application.properties, an administrator must distribute that key repeatedly. A stolen configuration file exposes encrypted data, and a known compromise may require replacing keys throughout the system. section 6.1
Public-key cryptography changes the distribution model. Each service has a mathematically related public–private key pair: the public key can be shared, while the private key remains secret. Public keys support encryption or verification; private keys perform decryption or signing. Certificates help prove that a shared public key belongs to the claimed service, limiting tampering and impersonation during exchange. section 6.5 section 6.2
Use the distribution model that matches the communication requirement:
- Use public-key encryption when recipients need to encrypt data for a service without receiving its private key. section 6.5
- Use digital signatures when recipients must verify integrity, authenticity, and the signer’s identity; the signer keeps the private key and others use the public key. section 6.3.3
- Use hybrid encryption for large data: encrypt the content with fast AES, then wrap the AES key with RSA. section 6.5 section 6.6
- Replace a compromised private key with a newly generated key pair, and use certificates to validate replacement public keys. section 6.5
Figure 6.4 Each service has a unique public–private key pair; it freely shares its public key over the network with any other service that might ask for it. When two services want to communicate, they exchange public keys and use those keys to secure the communication link. If a hacker steals a private key, only the communication link using that private key is compromised. A hacker that has access only to the public keys can’t compromise the system’s security.
Compare unique service key pairs with shared symmetric secrets: public keys may travel over the network, while private-key compromise is isolated to the affected link. section 6.2
