Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It is my understanding that PGP permits multiple public keys, and in SSL you can only extract one public key? Is this correct? Is there any brief high level run down between the two. I don't feel as if I ever really understood how SSL works, and I'd love to get a better understanding.

share|improve this question

2 Answers 2

PGP is format for encrypted and/or signed messages, and associated asymmetric key pair management, meant for emails. SSL (now known as TLS) is a protocol for establishing a secure bidirectional tunnel for binary data, over an existing insecure bidirectional tunnel for binary data.

So both systems apply to widely different situations, and they are hardly comparable. One common point, though, is that in both case one entity (the email sender for PGP, the SSL client for SSL) must obtain the public key of another entity (the email recipient, the SSL server) and use it. Let's call A and B, respectively, these two entities. In both cases, B can have several key pairs. However, the dynamics differs:

  • PGP works in an "email" situation. Email is one-way and one-shot. There is no dialog. A must be able to obtain enough information about B and its keys to produce the email, and B must know enough to process the incoming email without having to ask A for further data. This implies that A must obtain a copy of B's public key, and if there are several such keys, A chooses which key will be use.

  • SSL works for bidirectional connections. Client A and server B talk to each other, following a process called the "handshake", in which A and B agree on what cryptographic algorithms they will use (depending on what they both support and prefer). Specifically, the client announces what algorithms it supports (and in which order of preference), and then the server responds with the identifiers for the cryptographic algorithms that will be used. Then B sends its public key (in a certificate). If B has several keys, then B chooses the one which will be used (one which is compatible with the negotiated algorithms, of course).

That's the extent of the comparison between the two protocols: in PGP, sender/client chooses the key, which in SSL recipient/server gets to choose the key. Apart from that, they are too different in usage and context to be meaningfully compared.

See this answer for a primer on how SSL works.

share|improve this answer

To get down on the keys:

Both (PGP and SSL) have a public/private key pair. This keys are basically the same for both technologies.

The primary difference is how the public keys are signed (to create a certificate).

In SSL you use a X.509 certificate which is signed by another entity. It is also possible to self sign such a key. Then the key must be trusted in itself. All root certificates (from CAs) are self signed certificates.

In PGP the public key is signed by other owner of PGP keys. If enough people signed the key and this people are trusted by the receiver then you trust also this key. This forms a web of trust without any root entities.

For SSL you can also have a keyring as in PGP (and you will have if you use client certificates). This key rings are normally managed by your application (as the browser or an email client).

When you send an email signed/encrypted with PGP then you will also only use a single key for this email. This is the same as the single key used with a SSL server.

So the main difference between both technologies is the certificate handling (signing of public keys).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.