Assuming a situation in which Alice wants to send Bob an encrypted message by using a PKE, as far as I know, digital certificates allow both Alice and Bob to be sure that the public key they have is the one which actually correspond to the other one and it's not faked.

(If I'm wrong, please let me know)

But my question is: what is the step-by-step process for assuring that the public key contained in the certificate is the real one and it has not been modified?


The certificate is digitally signed by a 3rd party, e.g. a CA (certificate authority). This signature can be verified using the public key of the CA.

If the attacker modifies the public key, the signature won't match any longer.

If the attacker also finds a way to modify the public key of the CA, then you lost I'd say.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.