Public Key Infrastructure (PKI)
How your computer knows who really baked the key
Building on Asymmetric Cryptology
In our previous lesson on Asymmetric Encryption, we solved the key exchange problem.
Bob generated a key pair: A
private
Star Key (kept secret in his safe) and a public 
Triangle Key (sent over the open internet for anyone to
encrypt messages to him).
This solved the math of secrecy. But it left a critical, gaping vulnerability wide open: how do you know which public key belongs to whom?.
The Sneaky Koala Impostor (Man-in-the-Middle Attack)
Imagine Jane wants to send her confidential recipe to Bob's Bakery. When Jane requests Bob's public key over the network, what stops the sneaky Koala Cookie Thief from intercepting the communication, and sending Jane his own Koala Thief key instead?
Jane would unwittingly encrypt her recipe using the Thief's key! The Koala Thief decrypts it, steals the ingredients, re-encrypts the message with Bob's real key, and forwards it to Bob. Neither Bob nor Jane would ever realise their communication was hijacked.
Enter PKI: Public Key Infrastructure
Public Key Infrastructure (PKI) is the ecosystem of rules, roles, policies, and cryptographic protocols that binds public keys to verified real-world identities.
Instead of trusting an anonymous key floating over the internet, PKI relies on three fundamental ingredients:
- 1. The Certificate Authority (CA) - The Master Bakery Guild: A globally recognised, impartial organisation whose sole job is to rigorously verify organisations before issuing them an official stamp of authenticity.
- 2. Digital Certificates (X.509) - The Official Bakery Passport: An electronic document combining the owner's identity, domain name, public key, and expiration date, all permanently bound together with the CA's digital seal.
- 3. Digital Signatures - The Mathematical Wax Stamp: The cryptographic signature applied by the Certificate Authority that allows anyone in the world to verify authenticity in milliseconds while making forgery mathematically impossible.
Digital Signatures: The Mathematical Wax Stamp
At the core of every digital certificate is a digital signature. In asymmetric encryption, anyone encrypts with Bob's public key and only Bob decrypts with his private key. Digital signatures flip this relationship: the Certificate Authority hashes Bob's certificate and encrypts that hash using the CA's private key.
When Jane's browser decrypts the signature using the CA's trusted public key and confirms the hash matches, she gains mathematical proof that the certificate is genuine and has not been altered by an impostor.
Note: We explore digital signature mathematics, signing vs. verification algorithms, and non-repudiation in depth in a dedicated upcoming lesson.
The Chain of Trust: From Vault to Oven
Why does Jane's browser trust the Master Bakery CA in the first place?
Operating systems and web browsers come pre-installed with a curated list called the Root Trust Store. In our bakery analogy:
- Root CA: The Grand Master Baker. The Root Private Key is kept offline inside a safe or vault on specislied hardware and is never connected to the internet to ensure it is never compromised.
- Intermediate CA: Trusted regional bakery inspectors authorised by the Root CA to handle day-to-day certificate signing. This protects the Root Key from exposure.
- Leaf Certificate: Bob's individual bakery website certificate (https://bobsbakery.com).
Certificate Revocation: When a Star Key Crumbles
What happens if a rogue employee steals Bob's private Star key, or his server gets breached? PKI provides real-time safety mechanisms to revoke a compromised certificate before its official expiration:
- Certificate Revocation Lists (CRL): A regularly updated bulletin published by the CA listing cancelled certificates.
- Online Certificate Status Protocol (OCSP): A real-time query where Jane's browser checks live: "Is Bob's certificate still valid right now?"
Note: We will explore certificate revocation protocols (CRLs, OCSP, and OCSP Stapling) in greater detail in a dedicated upcoming lesson.
Interactive Visualiser: The Identity Problem vs. The PKI Solution
Explore how Public Key Infrastructure solves the identity trust problem. Run Example 1 to see how an anonymous public key allows a Man-in-the-Middle attack, then run Example 2 to see how a Certificate Authority and digital signatures prevent it.
Example 1: The Identity Problem (No Certificate)
Bob wants to sell biscuits to Jane. But Bob's public key has no verified identity attached. Click '1. Bob Bakes Keys' to begin.
Jane's Browser
🌐 The Untrusted Internet (Koala Spy)
Bob's Bakery
The Modern Web: How Every HTTPS Connection Works
Every single time you see the 🔒 Padlock icon in your browser's address bar (including on this very site, https://bytesizedcryptology.com), your browser just performed this exact PKI handshake in under 50 milliseconds!
Without PKI, asymmetric encryption would be helpless against impersonation. With PKI, cryptographic math guarantees you are communicating with the authentic server, keeping passwords, credit cards, and secret biscuit recipes completely secure from prying eyes!
