Public Key Authentication

From Computing and Software Wiki

Revision as of 15:02, 5 April 2009

Public key authentication, also known as asymmetric-key encryption is a cryptographic process that involves the generation of a key pair; a public key and a private key for encryption and decryption of messages, as well as the verification of a user's identity on a server. The private key is kept secret on the user's system who generated it, while the public key is distributed to any user or server with which the user wishes to communicate.

Messages are encrypted using the public key, and may only be decrypted by the corresponding private key. In this way, possession of the private key is required for the message to be read and third parties are prevented from intercepting the message. Similarly, the private key can generate unique signatures that could only have come from that specific private key. Using the matching public key a server can verify the signature provided and therefore the user's identity.

Background

• briefly explain password-based/symmetric key authentication
• go in more detail on public key authentication

Identity Verification Process

• Generate a key pair on your computer
• Copy your public key to the server
• When authentication is required, a signature is generated using the private key
• Server uses the public key to verify the signature and grant access

Message Encryption/Decryption Process

• Generate a key pair on your computer
• Send your public key to the desired user you wish to communicate with
  • Recipient may generate their own key pair
• Sender uses the recipient's public key to encrypt the message and sends it
• Recipient uses their private key to decrypt the message

Physical World Equivalent

The process of message delivery in networking resembles the postal system of the physical world. Encryption of the messages themselves is like locking the parcel with a padlock. Using a symmetric key would involve a single padlock with each user possessing an identical copy of the key used to open that padlock.

Alternatively, the use of a public (asymmetric) key system is equivalent to each user purchasing their own key/padlock set and sending the padlock to the user with whom they wish to communicate. This second user would then use this received padlock to lock up any messages they wish to send. The first user then unlocks the padlock with the matching key that they remained in possession of the entire time.

Benefits

Hacked Server

One advantage the public key authentication possesses over those that are password-based is when the server has been hacked or spoofed. In systems that use symmetric keys for authentication, the attacker can learn your password and proceed to pose as you in the future. Alternatively, if a server using public key authentication is hacked the signature sent to the server would mean nothing to the attacker. Without the private key, the attacker cannot impersonate you.

Brute Force Attacks

While brute force attacks are still possible in public key authentication given unlimited computational power of the attacker, the length and complexity of the keys generated in these algorithms make attacks by power limited threats very time consuming to the point that the information is no longer useful by the time the attacker has cracked the encryption.

Drawbacks

Although brute force attacks are generally ineffective against systems using public key authentication, there are other attacks that are capable of breaking the keys.

The same beneficial length of the generated keys that make them hard to crack by brute force attacks also cause the computational costs of using these algorithms to be much greater than the costs required in symmetric key algorithms. As a result, there are hybrid systems that use a public key to allow users to join a confidential session. Once the users have been granted access to the session, future messages are encrypted using symmetric keys to save on computational power.

Public Key Algorithms

There are many different algorithms used to generate the private and public keys in asymmetric key authentication.

• Primes
• Factoring
  • RSA (Rivest-Shamir-Adleman) algorithm
• Discrete Logarithms
  • DSA/DSS (Digital Signature Standard) algorithm
  • Diffie-Hellman algorithm
• Lattices
• Digital signatures

References

• [1] - Using Public Key Authentication
• [2] - Public Key Cryptography
• [3] - Public Key Cryptography
• [4] - Asymmetric Ciphers

See Also

External Links

• Public Key Encryption at HowStuffWorks.com

--larocqt 11:02 AM, 5 April 2009 (EDT)