0
$\begingroup$

In order to provide authenticity of a sent message, we use certificates as fingerprints. But how do I know that the certificate is not stolen by someone? If the certificates are made public, why cant an attacker just take someones public certificate and identify himself as someone else?

$\endgroup$
1
  • 1
    $\begingroup$ You need to read some books or take lecture on public-key cryptography. The Root Certificate key are generally physically distributed , however, we have some examples historical and supply chain attack is the new method. So, you don't know until they tell you. You can only look on the certicate chain for validation. $\endgroup$
    – kelalaka
    Oct 11 '21 at 20:17
2
$\begingroup$

A digital signature makes use of two keys a private key that can be used for producing signatures and a public key that can be used for verification of signatures. The certificate contains information that ties the identity of the signer to the public (verification) key but does not allow anyone to deduce the private (signing) key.

Anyone can present a certificate claiming to be the true signer, but only the true signer should be able to produce signatures that verify correctly.

If someone is able to steal the private (signing) key, they could indeed forge messages. For this reason the private keys should be stored privately and securely rather than broadcast in the way that the public certificates are.

$\endgroup$
6
  • $\begingroup$ so what do we need certificates for, if we can create signatures with our private keys and let others check them with the public key we provide? doesnt the signature give the same level of authenticity as a certificate? $\endgroup$
    – user96467
    Oct 11 '21 at 18:54
  • 2
    $\begingroup$ Without a certificate all you know is that the signature was made by the same person who made other signatures. The certificate ties the public key to a particular identity. With the certificate you are assured that the signer is amazon.com or Fred Jones. $\endgroup$
    – Daniel S
    Oct 11 '21 at 19:00
  • $\begingroup$ and how do I create a certificate? is it also created using private and public keys? $\endgroup$
    – user96467
    Oct 11 '21 at 19:25
  • 1
    $\begingroup$ You apply to a certificate authority whose identity is tied to a public key distributed with your web browser/operating system. They will hopefully conduct a rigorous check that you are who you claim to be and then sign your public key to make a certificate. $\endgroup$
    – Daniel S
    Oct 11 '21 at 19:30
  • 1
    $\begingroup$ TLS client authentication (with client certificates) is most commonly used for "smart" devices that connect back to a manufacturer, so the manufacturer controls the client (the device) and the server and runs a custom Certificate Authority both trust. $\endgroup$ Oct 12 '21 at 3:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.