Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • 14
    The channel only needs to provide authenticity, not secrecy. And in the case of certificate authorities, establishing such a channel is only difficult for the root certificates. Once a set of trusted root CAs is available (which come preinstalled in browsers, for example), you can simply use TLS to establish an authenticated channel to a CA, get a certificate from them and then use this certificate for an arbitrary number of your users. Commented Jun 12, 2023 at 13:44
  • If you have communication channel that is authenticated, but not encrypted, you can use Diffie Hellman to establish an encrypted channel with symmetric secret keys. Commented Jun 13, 2023 at 3:41
  • 5
    Yes, DH is a form of public key cryptography. So it's still a fundamental change to the security model provided by asymmetric cryptography. Commented Jun 13, 2023 at 4:41
  • 2
    I must admit that I found a few lines in "Cryptonomicon" to be a useful summary: Avi dictated a fingerprint to Randy over the 'phone, Randy collected Avi's public key from an accessible server, and later generated and sent his own public key to Avi encrypted with Avi's public key. Commented Jun 13, 2023 at 10:34