Public key infrastructure (PKI) is a clever piece of technology that applies some nifty mathematics. It sounds highly technical for most people, but fundamentally it provides a framework for trust – and therefore security – in an online environment.
Think about it. The internet is an electronic wild west, with unknown risks involving unknown people. Not all of those people are trustworthy. Despite this, every day we use the internet to log into banks, sign contracts, transfer millions of dollars, buy products from strangers, and exchange confidential information with people we’ve never met. Every message on the internet can potentially be intercepted, copied, deleted, or altered. And therefore all of our data on the internet is at risk.
This was fundamentally an issue before the internet. If we had an important message to send to another person, and didn’t want it to be usable if intercepted, encoding the message in some way was generally the best way to achieve this. For this system to work, however, we needed to have some infrastructure in place. Both the sender and receiver needed to know the encoding mechanism so that the message could be unlocked at the other end. This means the mechanism needs to be agreed in advance. The sender might use a wax seal with a proprietary imprint to authenticate the message was from them. There might be other rules and protocols agreed in advance (or somehow included in the message) to ensure the message was hard for people not knowing the mechanism to decode the message. The message may have a mechanism to demonstrate the message had been opened and/or tampered with while in transit.
Over the years some fancy methods were developed to facilitate such exchanges, from codes and ciphers to punch cards, code books, and one-time pads. All of these operated the same way: a shared secret, established in advance. This is an effective model, depending on how strong the encoding system was, but this approach doesn’t scale. While it is conceptually feasible for you and each of your trading partners (e.g., suppliers, customers) to agree a secret key (like a password) beforehand, you would still need to store and manage these secrets. And each of your online partners would need to do the same for their online partners, and so on. This approach becomes impractical very quickly.
And this is the problem public key cryptography effectively solves. Two parties who have never met, have not shared a secret beforehand, can establish a secure communication channel over an otherwise insecure network line the internet. Public key cryptography solves this problem so elegantly that it underpins almost every secure online service we use today.
How Does it Work?
Behind the scenes there are lots of technical details and fancy mathematics that rely on very large prime numbers and the improbability of the complex equations being solved in a timely manner. From a business perspective, those details are not important. What you do need to appreciate is that it works. Rather than dive into the technical minutiae, we’ll proceed with an analogy: a padlock.
Instead of sending you a secret to encrypt the data you are sending me, I send you an unlocked padlock with space inside for your message. Anyone can lock the padlock, but only I hold the key to open it. The padlock is the public key. Because it is public, it is not a secret. Only I have the private key, the only key that can unlock the padlock. That stays in my (figurative) pocket. I don’t reveal that to anyone.
The most common use of PKI for internet users is the HTTPS protocol. Looking at what happens to establish the secure connection shows how PKI works. When you connect to a website, the website gives your browser its public key – the empty, open padlock. The public key is derived from the site’s digital certificate.
Digital certificates are part of the PKI infrastructure. They rely on a chain of trusted third parties that issue the digital certificates. You don’t need to have a trusted relationship with the certificate provider, but you see that the trust can be securely related back to a party you can consider trustworthy (e.g., Google, Amazon, or Go Daddy). The site’s digital certificate is essentially saying “You trust the certificate authority that issued the certificate, and you can therefore trust this site.” A site’s digital certificate is linked to the site’s domain name. If the digital certificate is used on another site/domain name, your browser will flag this as an error.
When a website offers a public key based on its digital certificate, it is therefore also authenticating itself. Even though the public key – the unlocked, empty padlock – is freely available, it could only have been legitimately issued by that website. This provides an initial level of security.
Next, your browser creates a temporary session key, which is a completely random secret key. This key only lasts as long as the connection to the website is maintained. This session key is encrypted using the website’s public key. Your browser puts your secret key in the website’s open padlock, and closes it. Remember, only the website has the key to unlock the padlock. If the padlock is intercepted in transit, it can’t be opened without the key. The website never shares they key, so the contents of the padlock is useless to the interceptor. Capturing the message between your browser and the website gives away nothing. It is simply a string of useless data.
The website receives the locked padlock, uses its private key to unlock the padlock (decrypt the message), receiving the session key created by your browser. This gets used to establish the secure connection between the website and your browser, and for the remainder of that session, data exchanged are encrypted using the shared session key. Neither side revealed their private key, and no secret needed to be shared or known in advance.
It is worth noting the public key infrastructure is only used to establish the secure connection. Thereafter, once the parties have the temporary session key, that key is used to encrypt and decrypt the data while in transit, protecting it from interception. This is called symmetric encryption where both parties use the same key. Public keys require a reasonable level of computation power to operate, and would slow down communication if used exclusively.
The PKI enables the establishment of a secure communication path without the prior distribution of shared secrets. Complete strangers can establish a trusted connection over an insecure network – the internet. The system scales extremely well, and fundamentally enables secure commerce the internet. As a whole, the technology underlying PKI are some of the most important technology developments of the last 60 years. In most cases, you don’t even know you are using it.
The Underlying Mathematics
You don’t really need to understand the mathematics that makes all this work in order to use and trust the outcomes. I am not diving too deep here, but if mathematics isn’t your thing, you can skip this section. At most I will try and explain why all this is very clever.
The mathematics behind public key cryptography is both beautiful and surprisingly unintuitive. There are a series of core ideas that underpin cryptography necessary to appreciate how it works.
The first is something that falls into the unintuitive bucket: some mathematical problems are easy to do but extraordinarily difficult to reverse. By analogy, an example: It is very easy to shred paper, but extremely difficult and time-consuming to reconstitute those pages from the shredder output. In cryptography, this difficulty relies on the computational load required to perform this reversal. Like shredding, a one-way mathematical operation might take a fraction of a second. Reversing this same operation could take longer than the age of the universe.
Public-key cryptography is built around such one-way functions. The public key is created using mathematics that anyone can apply, but reversing those same calculations to discover the private key is considered computationally infeasible. The security doesn’t depend on keeping the algorithm secret. It depends on the practical impossibility of solving the underlying mathematical puzzle.
The effect is something like a trapdoor. Easy to go through, but difficult to go back – unless you have the secret key. That key makes a calculation that would otherwise be unimaginably difficult suddenly straightforward.
The secret to the mathematics is not that the reverse equations can’t be solved. The process instead relies on how long it would take to solve them. Given enough time and computing power, most private keys could, in theory, be discovered through brute force. The problem is one of scale. Modern public keys are, numerically, so large that the number of possible private keys is almost beyond comprehension. Security comes not from impossibility, but from overwhelming impracticality.
There is, of course, a problem with the impracticality as measured in computational terms. As computers get faster, the time to solve there equations gets shorter. It takes around five years, based on Moore’s Law, for processor power to improve 10-fold. So something encrypted 20 years ago with technology that assumed an average of 10,000 years to decrypt would be feasible today in 1 year. Fortunately, in most cases, 20-year old data is generally no longer deemed to still require the same degree of confidentiality.
To counter this improvement in computational power, we use longer (and therefore stronger) keys. The longer the key, the longer it takes to crack using brute-force attacks. If you have the right key, the decoding remains trivial.
The caution that must be raised here is that today’s public-key systems generally rely on mathematical problems that are hard for conventional computers but could become trivial tasks for what are seen as the next big step in computing, large-scale quantum computers. We are just now seeing the first-generation of these devices emerge from laboratories around the world, and they operate on totally different computing paradigms. In theory, brute-force decryption on quantum computers could be undertaken in minutes or even seconds. Nothing to date has been demonstrated beyond the laboratory. As a response, researchers are already developing and standardising new forms of post-quantum cryptography based on entirely different mathematical problems. The core concept remains the same: one-way algorithms that are computationally improbable to reverse.
If we can’t rely on the public key infrastructure to give us on-the-fly secure, trusted connections, online commerce stops. The stakes are now too high. We need a viable solution to protect ourselves now, and in the future.