How does SSL relate to the Public Key Infrastructure?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
SSL and TLS (the newer version of the standard) is one of many transport mechanisms that allows PKI to work over the network (originally, there was X.500). I'll be using TLS for the remainder of the answer. It's outside the scope of this forum to describe PKI in full. The exact handshake is like a ballroom dance. Essentially TLS defines the framework for the server and client to identify themselves and agree on an encryption standard and key. It is this identification process that makes PKI possible through TLS.
I'm assuming you are familiar with public and private keys as well as certificates. Everything past this point assumes familiarity with those terms and concepts. Also note that TLS has several encryption and encoding standards, and not all of them support PKI. Typically, both the client and server will need signed X.509 certificates to identify themselves.
Both the server and the client have identities. In a typical online retail situation, the only entity that is really important is the server. The clients have to have confidence that they are interacting with the server they intended to. Just about all retail servers that use SSL/TLS have a certificate, which is a signed public key that advertises the signature authority.
With PKI, the server also needs to know if the client has permission to access the server. The public client certs are signed by a trust authority that is known to the server (i.e. the server has the public key for the trust authority and validates certificates against that trust cert).
The TLS wikipedia article has the exchange for the three types of handshakes (simple, client-authenticated, and session resume). The handshake that makes PKI possible is the client authenticated handshake. A really simplified version of the handshake is below:
Wikipedia has a lot less slang, but this is the basics of how PKI works over TLS. The client needs to be confident that it has the right server, and the server needs to be confident the client is who they say they are.
Important note: The effectiveness of the key exchange depends entirely on how the keys are managed. This means the policies and procedures for identifying that a client's key is in fact tied to that client is not sound, neither will the PKI be robust. Additionally, if the trust authority's private key is known by a number of people, or is unencrypted, then that trust authority cannot be trusted. The same with the client private key. TLS handles the Public Key part, but the Infrastructure is all in how you manage the keys that cooperate in this whole exchange.
In brief: SSL makes use of PKI in operations.
This includes use of asymmetric cryptographic algorithms and public and private keys, contained and associated with X.509 certificates, which are one of the most important parts of PKI. Now, SSL validates the certificates, and during validation it uses several PKI protocols and standards (CRLs, OCSP requests etc).
SSL is short for Secure Socket Layer. It is a standard for secure communication implemented in software. It uses and distributes certificates.
A typical application of SSL is sending and receiving email.