Search code examples
sslencryptionopensslssl-certificatepki

In PKI if everyone knows the public key does it mean anyone can decrypt ....?


In PKI if everyone knows the public key of the server does it mean anyone can decrypt the server response to the client which is encrypted by the private key which in turn can be decrypted by the servers public key as long as someone can sniff somebody else traffic by being in the middle ?


Solution

  • In it's simplest form, public key crypto is used for one-way communication.

    If Alice has a public/private key pair, and she gives the public key out to everybody, then anyone can encrypt a message using Alice's public key that only Alice can decrypt using her private key. Alice does not use her private key to encrypt messages for others to read.

    For two way secure communication, public key crypto is typically used to transmit a session key that two parties can use to communicate securely.

    Let's say Bob wants to talk to Alice. With Alice's public key in hand, Bob uses it to encrypt a secret key and send it to Alice. Alice then uses her private key to decrypt the secret key. Now the secret key is known only to Alice and Bob. So they can both use the secret key with a symmetric encryption algorithm such as AES to send messages back and forth between the two of them.

    One thing Alice can do with her private key is create a digital signature. Alice can compose a message, hash the message, then encode the hash with her private key. Then Alice sends the message along with the encrypted hash out publicly. Anyone who has Alice's public key can decode the hash and ensure that the hash of the message matches the encoded hash. Because only Alice could have created the encoded hash, the reader knows that Alice did in fact send that message.