10.5 Management of Public Keys

Open key cryptography makes it workable for individuals who don't share a typical key ahead of time to by and by convey safely. It additionally makes marking messages conceivable without the nearness of a trusted outsider. At last, marked message digests make it feasible for the beneficiary to confirm the uprightness of got messages effectively and safely.

Nonetheless, there would one say one is issue that we have sparkled over a bit too rapidly: if Alice and Bob don't have any acquaintance with each other, how would they get each other's open keys to begin the correspondence procedure? The undeniable arrangement—put your open key on your Web website—does not work, for the accompanying reason. Assume that Alice needs to gaze upward Bob's open key on his Web webpage. How can she isn't that right? She begins by writing in Bob's URL. Her program then gazes upward the DNS location of Bob's landing page and sends it a GET ask for, as appeared in Fig. 10-23. Tragically, Trudy catches the solicitation and answers with a fake landing page, likely a duplicate of Bob's landing page aside from the supplanting of Bob's open key with Trudy's open key. At the point when Alice now encodes her first message with E_T , Trudy unscrambles it, understands it, re-scrambles it with Bob's open key, and sends it to Bob, who is unaware that Trudy is perusing his approaching messages. More regrettable yet, Trudy could change the messages before re-scrambling them for Bob. Unmistakably, some instrument is expected to ensure that open keys can be traded safely.

Figure 10-23. A route for Trudy to subvert open key encryption.