I understand that exchanging public key between parties is challenging task in asymmetric cryptography.Can someone help me understand how it is achieved?
3
-
1In what system? You can exchange it in lots of ways. In PKI, each server's certificate (containing the public key) is signed by the private key of a CA, whose corresponding public key is pre-installed into your device's key store. But this is just one way of doing it; it's entirely dependent on the protocol / system.– PolynomialCommented Apr 8, 2016 at 9:12
-
1Public Key is meant to be "Public" and is quite visible to others. Doesn't really matter how it is transferred.– JOWCommented Apr 8, 2016 at 9:52
-
1@JOW, Yes, it does matter, quite a lot in fact. It matters because we need to be able to verify that it actually belongs to who we think it belongs to, and that it has not been tampered with.– XanderCommented Apr 8, 2016 at 12:48
Add a comment
|
1 Answer
Even though I think you might be referring to the secure key exchange process (for this, I suggest you have a look at Diffie-Hellman as an example) rather than to the public key specifically, I will answer the original question because I have always been taught not to divagate.
There are three main ways you can exchange a public key with someone:
- Manually: you simply take your public key and send it to the recipient. This is often done when you use PGP with some of your contacts, for example, if you decide not to upload it to one of the key servers;
- Automatically: your computer comes with a bunch of certificates built-in, which of course include the relevant public keys. In this case, you don't have to do anything as you already own a list of trusted public keys;
- You use a directory: this is the typical implementation in the workplace. You probably already have a directory with user account information, so you can add the users' public keys as an extra piece of information in a user account.
answered Apr 8, 2016 at 11:33
