Public-key infrastructure

As explained in Real-World Cryptography

The web public key infrastructure is the ecosystem of browser-trusted authorities, certificates, and procedures that authenticates public keys for web connections.

A public-key infrastructure (PKI) turns one trusted authority into a scalable way to authenticate many public keys. The authority signs statements such as “Charles’s public key is 3848…,” allowing others to verify the mapping without already knowing Charles. section 7.1.3

Web PKI follows a simple trust chain:

• A browser arrives with verifying keys built into the program and trusts multiple authorities. section 7.1.3
• A website proves control of its domain to an authority, which signs the website’s public key. section 7.1.3
• During a secure visit, the browser verifies the authority’s signature, helping reject a public key supplied by a man-in-the-middle attacker. section 7.1.3

Beyond websites

S/MIME uses PKI rather than a web-of-trust model to authenticate identities and public keys in organizational email, especially where employee onboarding and offboarding are managed centrally. section 10.3.3

Figure 7.3 In the web PKI, browsers trust an authority to certify that some domains are linked to some public keys. When visiting a website securely, your browser can verify that the website’s public key is indeed theirs (and not from some MITM) by verifying a signature from the authority.

Trace how a browser trusts an authority’s signature to connect a domain name with the correct public key. section 7.1.3

How Real-World Cryptography covers it

How deep it goes

Explains transitive trust, signed key mappings, browser trust anchors, and domain validation, but stays high-level.

Examples

Uses browser-trusted authorities, signed website keys, domain ownership checks, and S/MIME-managed employee email identities.

What it assumes

Assumes public keys and signatures, while introducing trusted authorities and signed identity-to-key mappings.

What you can do after

Evaluate how browsers authenticate website keys and how organizational email systems bootstrap identity trust.

How it connects

Connects digital signatures, public keys, certificates, man-in-the-middle attacks, S/MIME, PGP, and SMTP.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Acing the Certified Kubernetes Administrator Exam, Second EditionPublic key infrastructure is a security framework that uses public-key cryptography and trusted certificates to authenticate parties and protect communications.

Compare how 2 books explain public-key infrastructure →

Related concepts

• certificateuses · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
• certification authorityuses · A certification authority is a trusted entity that verifies identities and issues digitally signed certificates binding public keys to identities or domains.
• S/MIMEused by · S/MIME is a public-key cryptographic standard for digitally signing and encrypting email using certificates.
• browserused by · A web browser is software that retrieves, interprets, and renders web resources, executes supported web content, and enables interaction with web pages and applications.
• digital signatureuses · A digital signature is cryptographic data generated with a private key and verified with corresponding public information to authenticate data or its signer and detect alteration.
• Kubernetesused by · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.