Pki

wild_eyed

doing a small report on public key/private key security and encryption, just a few questions, am i right in saying that PGP and SSL use the PKI as part of there encryption method and that PKI is not essentially a type of encryption in it's own right?
thanks.

dahamsta

Strictly speaking it depends on your definition of "type of encryption", because you could mean "type of encryption system" or "type of encryption algorithm". But that's just being anal and I'm guessing you meant the latter, in which case the clue is in the name: I is for infrastructure, so PKI is an encryption /system/. PGP specifically can use several encryption algorithms: CAST, IDEA, Triple-DES, and Twofish.

HTH,
adam

quinta

PKI is an encryption key management system.

PKI is also a horrible idea. The costs generally outway the benefits.

hmmm

PKI is an authentication mechanism that uses digital signatures certified by a trusted third party, i.e. the whole point is that you rely on a certificate because you trust the third party who has certified it. The encryption is really irrelevent, that's just mechanics.

PGP uses a different method of authentication, namely circle of trust. It's akin to a chain of certification, rather than PKI which is more pyramid like.

SSL is a form of PKI essentially, but don't say that too loudly or everyone gets confused.