🤔 The Trust Problem
A public key is useless if you can't verify who it belongs to⏱ ~2 min
You call your bank. Someone picks up and sounds professional. They ask for your account number. But how do you know this is actually your bank and not an impersonator who rerouted your call? In cryptography, this is the man-in-the-middle problem. Alice wants Bob's public key — but how does she know the key she receives is really Bob's and not an attacker's?
The Man-in-the-Middle Attack
- 1.Alice asks for Bob's public key
- 2.Mallory (attacker) intercepts the request and substitutes her own public key
- 3.Alice encrypts to Mallory's key, thinking it's Bob's
- 4.Mallory decrypts, reads or modifies the message, re-encrypts with Bob's real key, forwards to Bob
- 5.Alice and Bob think they're talking to each other; Mallory reads everything
The PKI Solution: Trusted Third Parties
PKI solves the key verification problem by introducing Certificate Authorities (CAs) — organizations whose public keys come pre-installed and trusted in every operating system and browser. A CA digitally signs a certificate that binds a public key to an identity (a domain name, an organization, a person). Because you trust the CA, and the CA vouches for the binding, you can trust the certificate.
PKI exists to solve which problem?