0

I am trying to understand how certificates works in cryptography. I have seen in my browser that is has a list of trusted certificates already. For example, when I want to connect with a secure server, I'll receive a server certificate during handshake comprising its public key and signature. As far I understood, browser uses CA's public key to decrypt the signatures of server certificate and then compare the hash of the contents. if it matches, certificate is considered legitimate. Now the questions is;

Q: If browser uses public key of CA, why does It keep complete certificate? and how browser decrypt key from CA certificate? isn't encrypted?

Improve this question

2 Answers 2

Reset to default
3

If browser uses public key of CA, why does It keep complete certificate?

When creating the trust chain from the servers leaf certificate to the local root CA certificate the browser the next certificate in the chain is found by looking for a certificate where the subject matches the issuer of the last certificate in the chain. Therefore it is not enough to only have the public key of the root but one needs also the subject of the root certificate.

and how browser decrypt key from CA certificate? isn't encrypted?

No, the certificate is not encrypted and contains the public key in clear. The main idea of public key cryptography is that the public key is is public and only the private key needs to be secret. Therefore the public key can be contained in clear in the certificate.

Improve this answer
1

So the information in a certificate is not encrypted. a certificate by definition is public and in simple terms contains information to identify the owner. You could consider a certificate like your passport.

It also contains the public key, in a sense you are publishing you public key so that others can encrypt messages to you. A signature is a cryptographic hash but not encryption. The server certificate is signed by the CA that means that the CA checks the contains of the server's certificate request creates a HASH and signs it.

You need the CA's public key to verify the signature, i.e. ensure that the signature is valid based on the hash calculations. The CA certificate is also used by the browser to validate the revocation checks. A browser should be requesting from the CA if the ID number of the certificate has been revoked.

Improve this answer
2
  • A signature is a cryptographic hash but not encryption. Are you sure, signing is not encryption. Hashing is just a checksum of the data and signing is done by private key of CA by AES, DSA for example and all these are cipher, encryption methods. ?
    – Wafeeq
    Commented Aug 30, 2017 at 10:56
  • The signature is a hash value (calculated via a hashing function such as SHA256) of the data that is part of the certificate, the signer then uses their private key to sign this hash. Technically that latter process is a form of encryption. To validate the signature, you calculate your own hash value of the certificate. then compare it with hash value from the signer which you extract with the signers public key. This image explains the process.
    – Fvt
    Commented Aug 31, 2017 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .