Trust and certainty in e-business – part 2

Cryptography, the field of knowledge dealing with the issues of information concealment through encryption, is involved in two security issues: privacy and authenticity. In a cryptographic system, a cryptographic key is very important, which is used to encrypt and decrypt a message. Symmetric encryption uses a private key, which is the same for both the sender and the recipient. Currently used keys, considered to provide a sufficient level of security, are 128 bits long. Symmetric encryption ensures privacy and authenticity, but it is very expensive because it requires unique keys for each communicating pair. Thus, if 10 entities want to communicate in this way, 45 keys are needed, but with 100 entities, 4950 keys are required. In asymmetric encryption, the communicating parties need two keys: a public one available to everyone and a private one specific to each participant in the communication. The public key is used to encrypt the message, and the private one to decrypt it. All cryptography using a public key is based on the assumption that it is computationally impossible to create a private key from an equivalent public key, while the reverse is possible. The described concept of public key encryption looks reasonable, but there is a major problem – how can an entity trust that a publicly available key is an authentic key belonging to the entity trying to communicate? For this reason, it is necessary to have a proper key management system so that it can be used securely. PKI (Public Key Infrastructure) defines the structure of the public key received by an entity for the purpose of encrypting information, providing a digital certificate that identifies the entity and the supporting organization. In other words, PKI defines a structure for cryptographic key management. In order to establish a relationship between an entity and its public key, PKI uses a data structure called a certificate, which links the identity of the entity with its public key and simultaneously contains information on how to use the public key. The certificate decides only one part of the trust issue, but the problem of how to trust the certificate remains to be solved.