Distribution of Public Keys

By: Jesse Miller

Several techniques have been proposed for the distribution of public keys. They can be grouped into the following public announcement, publicly available directory, public-key authority, and public-key certificates.

The point of public-key encryption is that the public key is public. If there is some broadly accepted public-key algorithm, such as RSA, any participant can send his or her public key to any other participant or broad cast the key to the community at large.

This approach is convenient, and has major weakness. Anyone can forge such a public announcement. That is, some user could pretend to be user "x" and send a public key to another participant or broadcast such as a public key. Before the user discovers the forgery and alerts other participants, the forger is able to read all encrypted messages intended for others and can use the forged keys for authentication.

A greater degree of security can be achieved by maintaining a publicly available dynamic directory of public keys. Maintenance and distribution of the public directory would have to be the responsibility of some trusted entity or organization.

It includes the following elements such as the authority maintains a directory with an entry for each participant; each participant registers a public key with the directory authority. Registration would have to be in person or by some form of secure authenticated communication.

A participant may replace the existing key with a new one at any time, either because of the desire to replace a public key that has already been used for a large amount of data, or because the corresponding private key has been compromised in some way. Periodically, the authority/organization publishes the entire directory or updates to the directory. Participants could also access the directory electronically.

For this purpose, secure, authenticated communication from the authority to the participant is made mandatory.
It is more secure than individual public announcements but still has vulnerabilities. If an opponent succeeds in obtaining or computing the private key of the directory authority, the opponent could authoritatively pass out counterfeit public keys and subsequently impersonate any participant and a message sent to the participant.

Quick Note: Taking the Nonsense out of looking for the right spyware remover

If you really want to take the work out of looking for that right Spyware Protection from a go to the Internet and get a or a Free
Download, In order to prevent your vital information from being ripped from your computer get your Remover Today.

Another way to achieve the same end is for the opponent to tamper with the records kept by the authority/organization.
Technology can be used for constructive and destructive purposes. Secured sites are never fully secured unless we gain some knowledge about the site and verify trusted certificates.

Top Searches on
Computers
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 
 • 

» More on Computers