0

I understand the theory behind public-key cryptography, but I want to know what real world entities Alice and Bob stand for in practice.

Does every web server have a key pair?

Every email address?

Every personal computer?

Every database server?

Every mobile device?

Every Facebook account (or other online profile)?

Every WhatsApp account?

  • 1
    Technically any of the things you mentioned could use public key crypto but most do not in practice. You should research when to use asymmetric vs. symmetric crypto. – d1str0 Nov 13 '16 at 17:47
  • 2
    I think the question is too broad. But public key cryptography is used in TLS so every HTTPS enabled web server uses it. It is used with mail (PGP, S/MIME, DKIM), DNSSec, SSH, Smartcards (including SIM cards for mobile phones) and lots of other cases. – Steffen Ullrich Nov 13 '16 at 17:58
  • Anything that generates a key pair or gets given a key pair has a key pair. Now, what things need key pairs depends on the protocol. With TLS the server has a key pair, so every TLS server (including most web servers for big sites) has a key pair. There are also systems for encrypting email, and if you're using one then you have a key pair, but if you're not then you probably don't, but you might have one for something else, and so on. – user253751 Nov 13 '16 at 23:32
  • Most VPNs have key pairs (both clients and servers). More importantly CAs, trusted companies whose business model is signing various public keys with their private key (thus creating "certificates"). – kubanczyk Nov 13 '16 at 23:37
0

Does every web server have a key pair?

It is common for administrators to log into webservers using SSH with public an private keys.

But from the perspective of the user, it's not every webserver which has an own keypair but rather every website (which isn't a one-to-one relation. A webserver can host multiple websites and a website can be hosted by multiple webservers).

When the HTTPS protocol is used, the website will transmit a certificate with its public key. The certificate itself is also signed with a private key: the key of a certificate authority. Your webbrowser comes with the public keys of several trusted CAs. This allows your web browser to verify that the certificate is genuine and the webserver really represents the website it claims to serve.

The HTTPS protocol is a quite good example of different kinds of cryptography used in everyday situations. When you want an introduction to applied cryptography, then HTTPS is a good subject to study.

Every email address?

In a perfect world, every email address would be associated with a PGP keypair. But in the real world end-to-end email encryption is unfortunately rather uncommon. Pretty Easy Privacy is a new attempt to make encrypted email more common. The future will show if it will catch on.

Every personal computer?

Not per se, but there is usually several software on a PC which uses public key cryptography in one way or another. A key can represent a computer, a specific program, a user (human or non-human) or an unique identity of a user. But usually only in the context of specific applications.

Keypair cryptography is also used in UEFI to verify the bootloader of the operating system or a TPM module.

Every database server?

Just as with websites, it is good practice to use keypair cryptography for logging into a database server. But in every database system I ever worked with, encryption is optional.

Every mobile device?

The SIM card in every mobile device contains an unique key which is used to authenticate with the base stations (the authentication key). It's not an example of public/private key encryption, because there is no other key. The cellphone provider has a copy of the key on their own server.

In addition, modern smartphones are practically miniature personal computers, so the same applies regarding keypairs used by arbitrary applications. Android has an API which allows applications to create and store keypairs on the device and so does iOS.

Every Facebook account (or other online profile)?

It rarely makes sense to give each online profile an own keypair. When you have a website, then all communication between the accounts happens within your trusted systems, so authentication and confidentiality is unnecessary.

When you want to develop a web application which uses client-sided public key cryptography, then you will run into the problem that Javascript still has no keystore API which allows to persistently store keys on the client in a way that they don't get lost easily.

Every WhatsApp account?

Whatsapp now uses end-to-end encryption which requires a keypair on each device.

0

You can tell if a web/mail/ssh etc. service is using public-private key encryption by looking at the address bar, and look for "HTTPS"

for example this website (stackexchange.com) is a real world entity that uses public key cryptography.

0

Does every web server have a key pair?

Yes, if it uses HTTPS. Note generally it's a certificate. A certificate is basically a public key, plus some basic meta-data (e.g., name of the organization, URL, etc), that is then signed by a trusted certificate authority. The private key was generated by the organization issued the certificate.

Every email address?

Generally, no, unless you use GPG or similar and sign/encrypt every email.

Every personal computer?

Possibly, and it may have many. Every linux/OS X computer running ssh has keypairs to allow hosts to identify themselves.

Every database server?

Not every database server (e.g., sqlite databases won't), but ones using encryption will require keypairs to be setup.

Every mobile device?

I don't think so, but some possibly do. Depends on device, whether it encrypts data at rest using asymmetric cryptography.

Every Facebook account (or other online profile)?

No. The only website I'm familiar with that makes you create certificates to authenticate with it, is startssl.com. Authentication via certificate creation is rate on the web.

Every WhatsApp account?

Not sure.

Not the answer you're looking for? Browse other questions tagged or ask your own question.