Who verifiesis responsible for ensuring the trusttrustworthiness of certificate authorities?

remove backtick misuse

Source Link

edited Dec 12, 2019 at 10:33

kelalaka

49.5k
12
118
205

Background

I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.

To mitigate this threat, people came up with certificate authorities that essentially "vouches" for the trust of 3rd parties by supplying you their respective public keys signed with the CA's own private keys.

Question

Here is where I am getting confused.

Can't we just use the same logic to intercept and compromise the transfer of information between the user and the CA (certificate authority)?

If the Certificate authorityCertificate authority vouches for the Generic WebsiteGeneric Website to insureensure trust and safety, who vouches for the Certificate authorityCertificate authority?

remove backtick misuse

Source Link

edit approved Dec 12, 2019 at 10:33

ThiefMaster

105
2

Background

I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.

To mitigate this threat, people came up with certificate authorities that essentially "vouches" for the trust of 3rd parties by supplying you their respective public keys signed with the CA's own private keys.

Question

Here is where I am getting confused.

Can't we just use the same logic to intercept and compromise the transfer of information between the user and the CA (certificate authority)?

If the Certificate authorityCertificate authority vouches for the Generic WebsiteGeneric Website to insure trust and safety, who vouches for the Certificate authorityCertificate authority?

Background

I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.

To mitigate this threat, people came up with certificate authorities that essentially "vouches" for the trust of 3rd parties by supplying you their respective public keys signed with the CA's own private keys.

Question

Here is where I am getting confused.

Can't we just use the same logic to intercept and compromise the transfer of information between the user and the CA (certificate authority)?

If the Certificate authority vouches for the Generic Website to insure trust and safety, who vouches for the Certificate authority?

Background

I am a novice in the field of cryptography and cyber-security, and while studying asymmetric-key encryption, I learned about the potential of a man-in-the-middle attack.

To mitigate this threat, people came up with certificate authorities that essentially "vouches" for the trust of 3rd parties by supplying you their respective public keys signed with the CA's own private keys.