If we decide to implement a public key infrastructure it turns out to be extremely functional and useful
for various applications.
Right now we'll just take a brief look and in a moment we'll return to individual cases.
What can we do with the certificate.
First of all we can verify the identity of Internet services probably no one would decide for example
to use electronic bank services.
If the communication from the Web site of that bank took place using h t t p instead of h t t p s protocol
it would be the same if communication was already established using HTP protocol.
But the bank's web site presents an invalid certificate
currently almost all Internet browsers help us with this.
If the certificate is invalid for some reason we'll speak about this later.
The browser blocks displaying the given Web site and warns us before we visit the site that something
is wrong with the certificate.
It may also do so on the address bar rather than the soothing green color of the address bar.
It's red which should draw our attention to the fact that something's wrong.
If we don't pay attention to it then we fall victim to a dual attack.
First of all men in the middle attacks which we've already talked about someone controls the channel
between us and the bank's web site and we really connect to the bank through the attacker.
The certificate of the attacker was displayed to us that this does not match the bank's address is signalled.
For example in red if we write there any of our confidential data it will be encrypted.
But the attackers will be used.
This doesn't make any sense.
The second type of attack is spoofing the bank's website very popular attacks at one time were based
on attackers registering domains whose names very much resembled their original domain name.
They used various tricks to do so for example double encoding or they used suitable words of a given
language and encoding the domain name domain names may be regionalised because we display it on our
side of the code we see for example the letter O as it should be in the name of a given bank.
But in fact it could be for example the letter O with an armload contemporary browsers also protect
us from such attacks.
And other uses encrypting file system meaning the possibility to encrypt files another is digital signatures.
We can prove that we're the sender of a message and convince the recipient that no one has modified
it by signing it digitally as described in one of the earlier modules
logging into systems using a smart card is also used in public key infrastructure.
On the smart card is written on a certificate with some private key secure electronic mail s mail everything
is based on certificates and on public key infrastructure.
If it weren't for that there's no point to encrypt something if we don't know to whom it will be sent.
We're not able to confirm the identity of the recipient.
Certificates also permit code signing not only signing data but also code signing.
Fortunately more and more programs are digitally signed.
If it comes to such a situation that all programs will be signed digitally.
We will be able to implement in our systems a simple policy stating do not run unsigned code with regard
to sign code run programs from this publisher and that publisher we will be safer.
Since we can identify code on this basis we can make some decisions software restriction principles
work in the way we just mentioned one of the methods of code identification is these certificates used
to sign it secure Internet protocol is based on using public key infrastructure.
We must somehow authenticate the other person certificate may be used to do this.
This is a significantly safer method than a shared key.
Also in the group is the ATO to dump one X standard we've already mentioned it during our training.
It may use certificates to authenticate both users and computers workstations and laptops in the central
part of the scheme shown previously.
There is a model structure of the public key for medium sized companies will have a root certification
authority often referred to as root another will be subordinate's certification authority which in contrast
to root will be online and will perform all requests on a regular basis.
At the very bottom of the hierarchy are functional certification authorities which will issue certain
types of certificates.
We'll explain in a further part of this module why it should look this way.