I'm trying to understand how public key encryption works, or better how the authentication process works.
As far as I understand the CA are here to pin a certain public key to a certain organization or person so that on one hand a person that signed anything with its private key can't say "this is not my public key" (non repudiation), and on the other hand that no attacker can send his public key and say its from someone else (otherwise you would encrypt your message with the attackers key).
But now the whole security depends on:
- browser developers that add certificates to the browser
- CA that create certificates
Isn't this a very low standard? I've read articles about governments forcing CA's to distribute false certificates (for example https://en.wikipedia.org/wiki/DigiNotar) or maybe the CA's get hacked themselves. And it puts the CA's in a very powerful position, which is never a good thing. Then the browser developers make decisions which certificates go into the browser.
Besides from this, it seems that the problem is just moved, since we need to get the public key of the CA to verify the certificate which in turn can also be a public key from an attacker (like Thomas Pomin wrote here: how digital signature verification process works) He says the problem is also concentrated which makes sense, but still, I can't really see how this should be trustworthy.
So to have authentication you necessary have some shared secret before the actual communication starts, which is not possible when you don't know the other person (Internet, etc). Therefore "real" public key authentication doesn't exist, right? Or better formulated, you can't protect yourself from a sophisticated attacker.
I've also read that many problems with SSL are mainly due to users that are not well educated in this topic (for example you could use client certificates that the server also knows who he is talking to, but it would be too complicated for the average user). But the key distribution seems also technically unsolvable, what do you think?