Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 509 / 554

Public-Key Encryption
487
provides a degree of authentication, since information encrypted with one symmetric key cannot be
decrypted with any other symmetric key. Thus, as long as the symmetric key is kept secret by the two
parties using it to encrypt communications, each party can be sure that it is communicating with the
other as long as the decrypted messages continue to make sense.
Symmetric-key encryption is effective only if the symmetric key is kept secret by the two parties
involved. If anyone else discovers the key, it affects both confidentiality and authentication. A person
with an unauthorized symmetric key not only can decrypt messages sent with that key, but can encrypt
new messages and send them as if they came from one of the legitimate parties using the key.
Symmetric-key encryption plays an important role in SSL communication, which is widely used for
authentication, tamper detection, and encryption over TCP/IP networks. SSL also uses techniques of
public-key encryption, which is described in the next section.
B.2.2. Public-Key Encryption
NOTE
The most common implementations of public-key encryption are based on algorithms
patented by RSA Data Security. Therefore, this section describes the RSA approach to
public-key encryption.
Public-key encryption (also called asymmetric encryption) involves a pair of keys, a public key and
a private key, associated with an entity. Each public key is published, and the corresponding private
key is kept secret. (For more information about the way public keys are published, see
Section B.4,
“Certificates and Authentication”
.) Data encrypted with a public key can be decrypted only with the
corresponding private key.
Figure B.2, “Public-Key Encryption”
shows a simplified view of the way
public-key encryption works.
Figure B.2. Public-Key Encryption
The scheme shown in
Figure B.2, “Public-Key Encryption”
allows public keys to be freely distributed,
while only authorized people are able to read data encrypted using this key. In general, to send
encrypted data, the data is encrypted with that person's public key, and the person receiving the
encrypted data decrypts it with the corresponding private key.
Compared with symmetric-key encryption, public-key encryption requires more processing and may
not be feasible for encrypting and decrypting large amounts of data. However, it is possible to use
public-key encryption to send a symmetric key, which can then be used to encrypt additional data. This
is the approach used by the SSL/TLS protocols.
The reverse of the scheme shown in
Figure B.2, “Public-Key Encryption”
also works: data
encrypted with a private key can be decrypted only with the corresponding public key. This is not