So back to Ballman file that we're trying to get to him.
So as I said to exchange I agree with Bob in a secure manner we need to authenticate that Bob is the
real Bob in order to exchange those keys because if a man is sat in the middle he could send a fake
public key pretending to be ball which is why we talked about hashes and digital signatures because
they are used within digital certificates as a method of authentication and this is the same when you
go to a hate's CPS Web site.
They have a public key which you're using to exchange session keys you know to start your encryption
you need to authenticate to make sure that that public key is legitimate.
Now one solution and the solution that is used on the Internet is to use digital certificates that are
digitally signed and a chain of trust.
So X dot 5 0 9 is the standard most used for the security digital certificates and they are simply a
digital document containing information about the owner of the certificate or for example the Web site
the business that owns the Web site.
In this case we've got more Mozilla the public key and a digital signature that proves the public key
and certificate of validated by an authorized typical authority.
Now that all may sound a little bit complex so let's run through this so maybe you've clicked on the
lock before the last.
Let's click on this and click on more info.
Sheilas click here first and you can see that it's verified by.
Did you sir.
So did you.
That is the certificate or 30 day of the person that is saying that Mozilla is who they claim to be
and that the public key on this certificate is genuine and has not been altered.
So let's actually look at the certificate itself down the bottom here we can see the negotiated algorithms
his view the certificate.
So this typically is valid for this domain only is validating this organization and it has been issued
by DGCA.
These are fingerprints they don't need to concern too much about these you can think of those is really
a unique number.
Are a hash against a certificate.
So it's really just a unique number for this particular certificate.
If you dig into the details
quick here if we go down
click here that is the public key
and we can see this is an RSA public key.
So if we encrypt something with that public key using the RSA algorithm only Mozilla's private key can
decrypt it.
Now if we go bit further down we'll see the digital signature algorithm.
So this is shot to five six with our saying correction.
So remember a digital signature is a hash value that is being encrypted.
The issue is private key.
So this is a big it has been signed by DGCA.
And if I click here their certificate is here and this is what brings us to our chain of trust because
the RSA public key that this certificate must be used to decode the signature on this first certificate
to obtain the Shaw 2 5 6 hash which must match an actual shot to 5:6 hash computed over the rest of
the certificate so that you know that it is genuinely from did you sir.
And the same process happens to validate that this certificate is valid.
Going back to this one up the chain of Trost which is the root certificate how do we know that this
form is valid and that we can trust this one.
Well that's because you're operating system and your browser contains a whole list of root certificates
that have been issued by certificate authorities.
So it's not that you necessarily trust them it's that Microsoft or whomever supplied your certificates.
It's those people that trust them.
Now if you going to view certificates in Firefox go here options advanced certificates view certificates
and if you click on authorities you can see the certificate authorities and these all the route CA's
that you're using to trust and they're all hundreds of them could come.
There we go see a komodo digital certificate.
Looks much the same as the mozilla one.
The difference is that this is a self-signed certificate.
What gives them the authority to be a certificate authority.
Well there is various organizations that enable this and allow this to happen and they have to conform
to various security requirements.
That's Close's
down the list.
And what was the
this was did you sir you can see here.
Did you see
and because we have this you know certificate store we trust the Mozilla Web site because of the chain
of trust the digital signatures we can see the chain of trust here.
Bank of America's certificate of trust comes down here and then we have the root certificate here.