Tutorial 2: Public-Key Cryptography and PKI

Unit 2 ยท Cryptography and key management

Objectives

Public-key systems use a public key for verification or encryption and a private key for signing or decryption. Digital signatures provide integrity, origin authentication, and evidence that a holder of the private key approved content; they do not automatically provide confidentiality.

signature = Sign(privateKey, Hash(document))
Verify(publicKey, document, signature)
certificate = CA_Sign(subject, publicKey, constraints)

PKI binds an identity to a public key through certificates signed by a trusted authority. Clients validate chain signatures, names, validity periods, key usage, and revocation policy. The private key is the high-value secret; protect it with hardware-backed storage where justified.

Exercises

  1. Describe a certificate chain from a browser to an enterprise service.
  2. Choose signing or encryption for a software release.
  3. List steps after a server private key is exposed.

Self-check

  1. What does a certificate bind?
  2. Which key is shared publicly?
  3. What does a signature not guarantee?

Self-Check Quiz

1. What does a certificate authority sign?

AnswerA certificate containing a subject identity, public key, and constraints, binding them under the authority's trust.

2. Which key must remain secret?

AnswerThe private key.

Homework

  1. Design PKI for internal service-to-service authentication.
  2. Write a certificate validation checklist.
  3. Plan emergency key rotation and revocation.
Sample answerValidation checks the chain to a trusted root, hostname or service identity, validity, key usage, algorithm policy, and revocation or status mechanism. Compromise requires containment, revocation where supported, replacement, audit review, and checking where the old key was trusted.