PKI & Digital Certificates Explained: Solving the "Trust" Problem in Cryptography

 

HELLO FRIENDS

WELCOME TO MY CYPHER LOG 

   Guys today we are going to see about the public key infrastructure and digital certificates. It plays the main role in keeping people away from fake organisations.

LET'S DIVE INTO THE TOPIC

PUBLIC KEY INFRASTRUCTURE

   We have already seen the public key in cryptography, actually it is a system that combines both public key and real world identity and it acts like a backbone of secure internet browsing.

THE DIGITAL CERTIFICATE

     We all have physical documents like our birth certificate and national Id cards there is a sign of a higher authority and we use those certificates to prove our identity right that's how this digital certificate works for websites and organisations.
If we receive any email or SMS we would like to see the header like we have already seen about that in our past blogs, actually we see that to know is that the real message from the real organisation.
Organisation would have a registered address as a Digital certificate and claim their ownership to the website and it contains an entity's name, entity's public key and the digital signature of the issuer and also an expiring date in that.

THE CERTIFICATE AUTHORITY

The digital certificate will be valid if the certificate authority has signed that.
CA is the highly secure and trusted organisation and they would likely check the entity's identity before issuing a certificate to them.

THE TRUSTED CHAIN OF PKI

It has three stages which is Root CA, Intermediate CA, End entity certificate.

THE ROOT CA

    The root CA is which is we all using daily which is Microsoft, Apple, Google Play Store to install applications. It is a self signed authority.

INTERMEDIATE CA

  The root CA's won't directly provide the digital certificates to the websites because of security reasons there where the intermediate CA works, the root CA's would issue certificate to intermediate CA and and it would be issued to the claimed website.

THE END ENTITY CERTIFICATE

   The certificate will installed on the actual website of the organisation or the user who claimed the ownership of the website.

If there were any scams that happened investigators would check if the user, your connection is not private and they clicking the proceed anyway button actually it happens because attackers creating their self signed certificates and the CA browsers would consider it as a redflag and give us warning.
There is a possibility of compromised CAs too but it's rare attackers might breach a CA and claim a certificate looking legitimate and it allows man in the middle attack.

REVOCATION

   If a private key is stolen the CA must invalidate the certificate.

so thats it guys these are things I have learned today, I hope you guys understood it.

if you want study guide to know more you can get through this link.

THANK YOU

Comments

Post a Comment

Popular posts from this blog

Day 2: Understanding the CIA Triad, AAA

Image
HELLO FRIENDS!! WELCOME TO MY CYPHERLOG Today I studied the fundamentals of cybersecurity - the CIA Triad and AAA Framework. by journaling this in this blog I pushed myself to be stay productive  it's really motivating me!! Let me break down what I learned in simple terms.   At first I have started with CIA Triad and AAA Framework actually this the basic foundation of cybersecurity so we need to understand it well to master it, as you thing its not an complicating topics because I too thought that, its just an simple topic which we can easily connect with our daily life, so let me explain it clearly. THE CIA TRIAD    CIA Triad is nothing but a combined term of three words which is CONFIDENTIALITY, INTEGRITY AND AVAILABILITY and we can call it as an three pillars of cybersecurity so let see how it is more important in cyber. CONFIDENTIALITY  CONFIDENTIALITY is, if you are authorized to the system or data like we can take our mobile or laptop as an example you're ...
Read more

Cryptography Basics: Encryption Types & Hashing Explained

Image
 HELLO FRIENDS WELCOME TO MY CYPHER LOG         Today I came up with a topic which I wondered about what it will be from the first year of my studies in cybersecurity, The cryptography.  In this blog we are going to un-wrap this topic and learn more about it. LETS GET INTO THE TOPIC CRYPTOGRAPHY     You may think that it can be difficult to learn but actually there's nothing like that because I too thought like that about this, if you still think it's difficult I will explain it Like you want.    Cryptography is encrypting data from a readable plain text to unreadable cipher text format. Cryptography is like a knife It has both advantages and disadvantages. Its purpose varies based on who uses it, if you want to use it to protect data it can keep it secure, On the other hand if an attacker uses it he can create a massive bad impact like implement the attack the ransomware. THE TWO MAIN TYPES OF CRYPTOGRAPHY     As I have mentio...
Read more

Cyber Security Day 4: Understanding Layered Security & Defence in Depth

Image
HELLO FRIENDS!! WELCOME TO MY CYPHER LOG Successfully I have learned continuously for three days without any procrastination and I am just feeling proud of myself,  I hope you guys too learn continuously without any distractions. Ok let's see what I have learned today,    In the last blogs we have seen about security controls in this blog we are going to dive into depth of defence in cyber security and also there is an architecture called zero trust, let's see how it works. Defence in depth    Security controls are just a single safety measure to prevent an attack but defence in depth are not like that as we can understand with the name itself it's controlling structure which will protect the asset from an attack layer by layer. And it has five layers.  If a company hosts a website they won't just rely on a single layer of security like five layers of controls Layer 1 is an external firewall that will automatically block the IP address which looks suspiciou...
Read more