Digital Signatures and Digital Certificates

Digital signing proves who encrypted the file, but only insofar as the Public Key actually represents the person involved. In the real world, as opposed to the world of mathematics, it becomes important to validate the person or organisation who is using a particular Public Key.

There are two ways of doing this. One is to use commercial Digital Certificates. The other is Peer-to-Peer Certification.

1. Digital Certificates - anonymous corporation generates your keys, validates your identity, you pay

Under this scheme you purchase a Digital Certificate from a commercial provider with an annual renewal charge. You must provide them with a lot of personal data such that someone could, if necessary, prove who you are. For example your National Insurance number, passport number, driving licence number, utility bills etc. They will then create your public and private RSA keys for you.

They publish your public key so that anyone can use it. Anyone then using that key has the potential to refer back to the supplier and validate who you are. Needless to say this system had a number of potential security problems. Just the fact that a remote organisation is holding your public and private keys and all your personal details is cause for concern, and there are other technical weaknesses in the system.

2. Peer-to-Peer Certification - generate your own keys, person at each end validates identity, no charge

Here you validate the identity of the person you are communicating with yourself. Lets say someone known to you sends you an email with an RSA-encrypted file. The software is able to create a code derived from their private key without giving the private key away. Because the sender is known to you, you can phone them or text them and check that the code matches up.

This how it works in practice. The software decrypts the file and displays an id-code. One time only, the id-code has to be validated with the sender. Therefore the first time you receive a file from Dave you call or text him for his id-code, which he gives you. Lets assume its 8736-2637 for example. If that matches the id-code you have displayed in your PTP then you know it is indeed Dave. This is much safer than an anonymous corporation doing the validation.

Obviously this system depends on your knowing the sender. However, in practice are you going to be exchanging confidential information with strangers ? The benefit is that no-one else in involved apart from the sender and receiver. In security, three's a crowd.

"Secure" Web Servers

Secure web servers use a form of RSA to create a secure link between a web browser and the remote server. The secure web page uses a special form of address called HTTPS which stands for Hypertext Transfer Protocol Secure and is a combination of the Hypertext Transfer Protocol with the SSL/TLS protocol to provide encryption and secure identification of the server. SSL/TLS stands for Secure Sockets Layer and Transport Layer Security. SSL and TLS are based on RSA encryption. HTTPS connections are used for credit card payment transactions on the World Wide Web which means that all credit card payments, online banking and internet shopping rely totally on RSA for security.

For a payroll service provider to exchange documents with their clients they can use an HTTPS web server. They upload files to the secure server and the client logs in and downloads them. There are a number of security problems with this methodology. First of all the data is only secure during the short time of transmission over the internet. It is not secure while it is on the remote server nor is it secure on the PC at either end. In addition there is the problem of password management for access to the remote server. It is unfortunate that the beauty of RSA in not using passwords to achieve a data delivery is compromised in this system by having to use passwords to gain access to the server.