The DMZ

Xander

00:44

0

I know facebook sells/trades my data with other entities as part of their business model, but I'm uncertain what this type of transaction is called and which companies purchase the data. Do you guys know?

facebook

Is that really on topic here? Thoughts?

Gilles

@Xander no

D3C4FF

@TildalWave I usually refer to that as a 'technical tap'

Xander

@Gilles Didn't think so. Thanks!

Griffin

01:08

@Gilles Okay here is what I think is happening. Client requests connection to server. Server says okay. Client asks for certificate. Server sends it public key (encrypted with private key). Client sends public key to appropriate CA. CA decrypts it and sends appropriate response back confirming or denying certificate.

Gilles

@Griffin no, the client never contacts the CA

The server doesn't send a public key, it sends a certificate

I'm sure the answers to your questions and the links you've been given cover that

Griffin

@Gilles The links give to much info to piece all the parts together. Can you give me the process in the same format I told you my idea.

Gilles

the certificate contains a signature by the CA of the assertion “237190649873 is example.com's public key”, where 237190649873 is the server's public key

the only way to produce such a certificate is to know the CA's private key, hence the certificate must come from the CA

and the client trusts the CA because it's been preloaded with a list of CAs to trust

Griffin

01:22

@Gilles I understand that the CA is trusted that's great and all I understand they're signed. That's wonderful. My problem is what does the private key actually do. How is the certificate signed? I know it's signed by the private key but how is it signed so that the user knows that it's actually signed

People keep trying to sell me them instead of tell me about them.

I read this "Client has the public key for Thawte (and many other third party companies) stored in its computer — because these come with the computer. Thus, client can decrypt the validation information, prove the validation is from Thawte and verify that the public key is certified by Thawte. If Client trusts Thawte, then Client can trust that he/she is really communicating with Company. If Client doesn’t trust Thawte, or whatever Third Party company is actually being used, then the identity of who is running the computers to which Client is connecting is suspect.

Gilles

Public-key cryptography

Public-key cryptography refers to a cryptographic system requiring two separate keys, one of which is secret and one of which is public. Although different, the two parts of the key pair are mathematically linked. One key locks or encrypts the plaintext, and the other unlocks or decrypts the ciphertext. Neither key can perform both functions by itself. The public key may be published without compromising security, while the private key must not be revealed to anyone not authorized to read the messages. Public-key cryptography uses asymmetric key algorithms and can also be referred t...

the client knows the CA's public key, so it can check that the signature comes from the CA

here Alice is the CA and Bob is the client

instead of “I will pay $500”, the message is “237190649873 is example.com's public key”

Griffin

@Gilles Here is a better question. Does alice have a private key?

bob

Sorry bob

Gilles

@Griffin yes, the CA has a private key

114

Q: How do certification authorities store their private root keys?

Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted certificates and selling them on the black market. Given the huge profits that could be made with...

public-key-infrastructure key-management certificate-authority certification key-generation

Bob doesn't have a key of his own

(he might have one, but it isn't used by the basic protocol we're looking at here)

Griffin

So I can encrypt this with one key and decrypt it with another?

Gilles

@Griffin there is no encryption going on here

Griffin

01:32

Sign and verify though?

Gilles

yeah, I know the picture says “sign (encrypt)”, but that's both technically improper and pedagogically confusing

the CA signs the certificate with the CA's private key

Griffin

This is what I'm thinking of upload.wikimedia.org/wikipedia/commons/thumb/4/4c/…

Gilles

the client verifies the certificate with the CA's public key

that's something else: a key derivation protocol

Griffin

So what's the math behind the first picture. I know that basic math behind the second.

Gilles

SSL has something of this kind, but it's not related to authenticating the server

RSA (algorithm)

RSA is an algorithm for public-key cryptography that is based on the presumed difficulty of factoring large integers, the factoring problem. RSA stands for Ron Rivest, Adi Shamir and Leonard Adleman, who first publicly described the algorithm in 1977. Clifford Cocks, an English mathematician, had developed an equivalent system in 1973, but it was classified until 1997. A user of RSA creates and then publishes the product of two large prime numbers, along with an auxiliary value, as their public key. The prime factors must be kept secret. Anyone can use the public key to encrypt a message...

Griffin