Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Learning about cryptography. Experimenting with attacking the algorithm it's self. My question regards vocabulary basically. Are encryption keys and certificates the same thing or are they different?
If they are the same, good, if not then how are they different?
I'm a newbie to this stuff but I'm pretty sure that I've been supplied with a symmetric AES certificate/key. I don't know what to call it. It's labeled certificate in the given file but my lack of understanding is hurting my research.
A key is generally just the data needed for encryption. A certificate contains additional info, such as domain the key belongs to, the organization it belongs to, when it expires etc. Certificates are usually signed by a different key to ensure their integrity. Certificates usually contain only public keys and are only used in asymmetric cryptography.
Certificates are used to create a Public Key Infrastructure (PKI). Generally the X.509 form of certificates are used, in which case the PKI is called PKIX, after the standard. The private keys that are part of a key pair are used to sign lower level certificates. This way a certificate can be verified by verifying a certificate chain where each certificate is used to verify the one below it.
PKI requires the use of public / private key cryptography, otherwise known as asymmetric cryptography. An example of an asymmetric algorithm is RSA. AES can only be used with a single secret key and is therefore part of symmetric cryptography: the same key is used for encryption / decryption or signature generation / verification. It's unlikely to the extreme that a certificate contains an AES key.
Encryption certificates are certificates that have been designated to perform encryption. This is performed by simply setting a specific key usage flag. So although the public key within the certificate can be used for any task (encryption or verification of signatures over data) the certificate indicates that it should only be used for encryption (or the function of any other flag that is set).
Asymmetric algorithms are however not efficient, so instead a symmetric key is established using the algorithm, e.g. by encrypting (or wrapping) a random symmetric key such as an AES key. This allows efficient encryption / decryption of the data. To decrypt the AES key is unwrapped in (preferably secure) memory and then used to decrypt the actual data. This is probably what you are expected to do: implement a hybrid cryptosystem using e.g. RSA and AES.
For asymmetric cryptography to be used to encrypt something you need to trust that the public key originates from the receiver. Certificates are used to establish the trust for the public key within the certificate.
Note that these are just the basics. If you have to send the ciphertext somewhere then you are trying to establish a secure transport protocol. That's very tricky, so generally you will be instructed to simply use SSL / TLS instead.
