Network Security - Public Key Infrastructure (PKI)

1. What is PKI?

Public Key Infrastructure (PKI) is a framework that manages digital keys and certificates to enable secure communication over networks.

It ensures:

  • Authentication – verifying identity

  • Confidentiality – keeping data private

  • Integrity – ensuring data isn’t altered

  • Non-repudiation – preventing denial of sending/receiving data

Think of PKI as a trusted system that issues digital ID cards (certificates) for computers and users so they can securely communicate online.

2. Key Components of PKI

  1. Public and Private Keys

    • Part of asymmetric cryptography

    • Public key → shared with everyone

    • Private key → kept secret

  2. Digital Certificates

    • Like an online passport that links a public key to a verified identity

    • Contains: name, public key, issuer, validity period, and digital signature

  3. Certificate Authority (CA)

    • Trusted entity that issues and signs digital certificates

    • Examples: DigiCert, Let’s Encrypt, GlobalSign

  4. Registration Authority (RA)

    • Verifies the identity of users or devices before the CA issues a certificate

    • Acts like a check-in desk

  5. Certificate Repository

    • Database where issued and revoked certificates are stored

    • Publicly accessible for verification

  6. Certificate Revocation List (CRL)

    • List of certificates that are no longer valid before their expiration

    • Ensures compromised or expired certificates are not used

3. How PKI Works (Simplified Flow)

  1. User or device requests a certificate from the RA.

  2. RA verifies identity and forwards the request to CA.

  3. CA issues a digital certificate and signs it with its private key.

  4. User/device uses the certificate for secure communication (encryption, signing).

  5. Others verify the certificate using CA’s public key.

4. Uses of PKI

  • SSL/TLS for websites (HTTPS)

  • Email security (S/MIME)

  • Digital signatures on documents

  • VPN authentication

  • IoT device authentication

5. Real-World Analogy

  • Public Key: Your public mailing address

  • Private Key: Your mailbox key

  • Digital Certificate: Government-issued ID linking you to your address

  • Certificate Authority: The government office verifying your ID