0
$\begingroup$

I'm learning publick key infrastructure and certificate authority.

But I cannot understand below conecepts.

Unlike KDC or public key authority, CA does not have to be online to provide keys to users

Why? I think KDC and public key authority are same as CA.

$\endgroup$
3
$\begingroup$

Unlike KDC or public key authority, CA does not have to be online to provide keys to users

What they mean by that is that the CA doesn't have to be on-line at the time of negotiation. That is, when you use TLS to take to Amazon, the CA doesn't have to be a part of the negotiation. Instead, Amazon can send its certificate and you can verify it (and then use the embedded public key) without the CA being involved direction. The CA can be (and generally is) shut off from the network during that time.

This contrasts with (say) a Key Distribution Center; when Alice and Bob need to negotiate a shared secret, the KDC is a necessary party within that negotiation.

This implies two things:

  • Because the KDC must be on-line, that means that it must present an interface to the users; such an interface is a potential attack surface. As the CA is usually off-line, it is rather more difficult to attack.

  • Scalability; because the KDC participates in every negotiation, that means that it gets a lot of traffic. Of course, there are ways to address this, such as redundant KDC servers; however that just increases the attack surface.

Of course, the CA does have to be available at the time of enrollment. What Amazon gets its certificate, the CA has to generate it and send it to Amazon. However, this is a comparatively rare event (compared to how often negotiation happens), and so less of an issue.

I think KDC and public key authority are same as CA.

No, they are not. A KDC is a central authority that distributes keys. How it generally works is that the KDC would share a symmetric key with each of its uses; when Alice wants to talk to Bob, it would send a request (using Alice's symmetric key) to the KDC; the KDC would generate a key, and send it to Alice (using Alice's symmetric key) and to Bob (often via Alice) using Bob's symmetric key.

$\endgroup$
  • $\begingroup$ Wow, amazing explanation! Thx poncho $\endgroup$ – baeharam Dec 12 '18 at 1:32
  • $\begingroup$ Also, we need to know the CA before. $\endgroup$ – kelalaka Dec 12 '18 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.