Public Key Infrastructure

Adobe, the major software corporation that brings us Flash, PDF’s, and the all-encompassing Creative Suite, experienced a major security breach last week when hackers were able to sign malware with one of their encryption certificates. The two signed programs discovered were rather minor pieces of malware, however the attacker’s ability to exploit Adobe’s signing structure poses a more serious threat. It also shines light on one of the key weaknesses of Public Key Infrastructure (PKI), the framework that enables SSL/TLS secured communication between servers and clients.

To fully understand this weakness, one has to understand how PKI actually works. A client or server will create what is called an “encryption key” that allows data to be encrypted based on the random characters inside the encryption key file. In traditional symmetrical encryption, that same encryption key is used to both encrypt & decrypt the data. This can pose a security problem because that key file has to be shared between all parties for them to understand each other’s data.

Asymmetrical encryption algorithms were developed that allow a party to encrypt data with one key, and decrypt it with another. Now clients and servers generate two keys, a private secret key file, and a public, accessible, key file. Party A that wants to communicate with Party B will grab Party B’s public key to encrypt the data, and Party B will use its secret private key to decrypt the information. This eliminates the need for users to share that secret key information.

In short, certificates are basically public encryption keys. Certificates are a way to distribute the public keys, and identify that those public keys really belong to the parties they claim they are. X.509 is the technical standard by which certificates are created. Normally most companies will request a certificate from a trusted third party, with their private key, who will then verify and generate a certificate to be distributed across the web for that company. These trusted third parties are called Certificate Authorities, and exist only to verify that companies are who they say they are, and aren’t malicious hackers after your information.

If the picture is any clearer now, you will begin to understand how dangerous a compromised certificate is. These hackers are able to pose as Adobe, distributing trusted software. It is even more serious when CA’s are breached, which happens more often than one would expect. This is why it is important to pay attention to your web browser. If a prompt appears claiming to not trust the “security certificate”, it’s usually a good indicator the website you are visiting is not who they claim to be.