"/home/yossef/notes/Su/security/study_security_l6.md"

path: Su/security/study_security_l6.md

- **fileName**: study_security_l6
- **Created on**: 2025-06-02 21:21:56

Public Key Cryptography Explained

Core Concepts

Symmetric vs Asymmetric Encryption

• Symmetric: Single shared key (fast but insecure key exchange)
  • Example: AES, DES
• Asymmetric: Key pairs (secure but slower)
  • Public key: For encryption/verification
  • Private key: For decryption/signing
  • Example: RSA, ECC

Key Features

• Solves two major problems:
  1. Secure key distribution
  2. Digital signatures (authentication + non-repudiation)
• Based on mathematical problems (factoring primes, discrete logs)
• Slower than symmetric crypto → Often used together (hybrid systems)

How Public Key Crypto Works

Encryption Flow:

1. Bob generates key pair (PUB_b, PRIV_b)
2. Bob shares PUB_b publicly
3. Alice encrypts with PUB_b: C = E(PUB_b, M)
4. Bob decrypts with PRIV_b: M = D(PRIV_b, C)

Digital Signature Flow:

1. Alice hashes message: H = SHA(M)
2. Signs with PRIV_a: S = Sign(PRIV_a, H)
3. Bob verifies with PUB_a: Verify(PUB_a, S, H)

Public Key Infrastructure (PKI)

Certificate Components:

• Issuer: Trusted CA (e.g., VeriSign)
• Subject: Owner's identity
• Validity period: Start/end dates
• Public key: Bound to subject
• CA's signature: Ensures authenticity

Verification Process:

1. Get certificate (e.g., from website)
2. Check CA's digital signature
3. Verify validity period
4. Extract public key

Review Questions & Solutions

1. Compare Symmetric/Asymmetric Crypto

2. Hybrid Encryption

• How it works:
  1. Use asymmetric crypto to exchange symmetric key
  2. Use symmetric key for bulk data encryption
• Why needed: Combines speed of symmetric with secure key exchange of asymmetric

3. Digital Signatures & Non-Repudiation

• Only the signer knows private key → Cannot deny signing
• Verifiable by anyone with public key
• Example: Sign(PRIV_a, SHA("Contract")) binds Alice to contract

4. Digital Signature Benefits

• Authentication: Proves sender identity
• Integrity: Detects message tampering (hash changes)
• Non-repudiation: Legal proof of signing
• Process:

    # Signing
    hash = SHA256(message)
    signature = Encrypt(PRIV_key, hash)

    # Verification
    decrypted_hash = Decrypt(PUB_key, signature)
    assert SHA256(message) == decrypted_hash

continue:./study_security_l7.md
before:./study_security_l5.md