Basic Cryptography - Clarify statement in Episode
-
@Daniel in the “GIAC Security Essentials” course, “Basic Cryptography” episode, (min 9:48) iDaniel said that he uses his Private Key to encrypt his message and sends it to Justin, and that Justing can unencrypt it with Daniel’s Public key, I am not sure this is the case, so wondering if you can confirm.
My understanding is you will always use the receiver’s public key to encrypt the messages so only that receiver can unencrypt with his own private key. -
Greetings, @Jose-Fernandez
Cryptography is indeed an odd thing to wrap your head around. Let's see if I can clarify it.
With PUBLIC KEY encryption, also known as ASYMMETRIC encryption, each person has 2 keys a PUBLIC key and a PRIVATE key, also known a s a KEY PAIR.
The fun thing about a key pair is that you can encrypt data using either key!
So, If I encrypt data with my PUBLIC KEY, only my PRIVATE KEY can decrypt it.
This is useful for when YOU want to send me something that only I can decrypt. This keeps bad actors from modifying your encrypted message and is usually used in conjunction with Digital Signatures, so that I can verify that the message actually came from you. This is called NON-REPUDIATION. So you are correct when you say that if you are sending me data, you should encrypt using my PUBLIC KEY.
But, I can also encrypt data with my PRIVATE KEY and only my PUBLIC KEY can decrypt it. This is useful for things like Digital Signatures.
When I encrypt a message with my PRIVATE KEY you can be sure that it was me that sent it, because only my PUBLIC KEY will decrypt the message.
Now someone could intercept the message, modify it, and re-encrypt the message with their key, but my PUBLIC KEY will not decrypt it because they didn't use my PRIVATE KEY to encrypt, thus alerting the recipient to the fact that the message didn't come from me.
I hope that helps clear up the confusion :)
Cheers,
Daniel -
Yes, I get now the use of encryption with the Private key. Appreciate you answering quickly. Cheers.
-