tags: cryptography
While it seems that there is no problem in distributing public keys in any kind of manner, an un-noticed problem may arise, how can you be sure that the owner of that public is really the owner he says to be ?
The problem is that anyone can just say hey I am A,I am part of the the org and here is my public key. Now any messages targeted to A, will be received by this guy, and if he generated a private key he will decrypt the message and read any message that was intended to A even if he is not A.
Certificate Authorities
Certificate authorities were created to fix these problems. A sends it’s public key to the certificate authority. The authority then verifies A and creates a certificate for A, A can then publish its certificate or send it to other users. The certificate is signed by encrypting its hash by the it’s private key.
The formal definition of a certificate and the info it holds
Certificate chains
Still certificates themselves have to be trusted and they are trusted by upper certificate authorities and so on till the root certificate authority that is already in your device.
NOTE: Root certificates are self-signed but trusted by the user manually.
