Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Learning about cryptography. Experimenting with attacking the algorithm it's self. My question regards vocabulary basically. Are encryption keys and certificates the same thing or are they different?
If they are the same, good, if not then how are they different?
I'm a newbie to this stuff but I'm pretty sure that I've been supplied with a symmetric AES certificate/key. I don't know what to call it. It's labeled certificate in the given file but my lack of understanding is hurting my research.
A key is generally just the data needed for encryption. A certificate contains additional info, such as domain the key belongs to, the organization it belongs to, when it expires etc. Certificates are usually signed by a different key to ensure their integrity. Certificates usually contain only public keys and are only used in asymmetric cryptography.
Certificates are used to create a Public Key Infrastructure (PKI). Generally the X.509 form of certificates are used, in which case the PKI is called PKIX, after the standard. The private keys within CA (Certification Authority) certificates that are part of a key pair are used to sign lower level certificates. This way a certificate can be verified by verifying a certificate chain where each certificate is used to verify the one below it. The private key of the leaf certificate can be used for any indicated purpose, excluding the signing of other certificates.
PKI requires the use of public / private key cryptography, otherwise known as asymmetric cryptography. An example of an asymmetric algorithm is RSA. AES can only be used with a single secret key and is therefore part of symmetric cryptography: the same key is used for encryption / decryption or signature generation / verification. It's unlikely to the extreme that a certificate contains an AES key.
Encryption certificates are leaf certificates that have been designated to perform encryption. Although a public key within the certificate can be used for any task that it is capable of (such as encryption, key agreement or verification of signatures over data) the certificate indicates that the public key should only be used for encryption by setting at least the encryption key usage flag in the certificate.
Asymmetric algorithms are not efficient, so usually a symmetric key - such as an AES key - is encrypted (encapsulated or wrapped) with the public key instead. This allows efficient encryption / decryption of the data. To decrypt the AES key is unwrapped with the private key and then used to decrypt the actual data. This is probably what you are expected to do: implement a hybrid cryptosystem using e.g. RSA and AES.
The sender needs to trust the public key to originate from the receiver. Certificates are used to establish that trust for the certificate and by extension the public key contained within it.
Note that these are just the basics. If you have to send the ciphertext somewhere then you are trying to establish a secure transport protocol. That's very tricky, so generally you will be instructed to simply use SSL / TLS instead.
