A public key – but who does it belong to?

Public-key cryptography solves the problem of key exchange, but leaves one crucial question unanswered: who does this public key actually belong to?

The problem

You want to contact your bank. A server responds and sends you a public key, claiming to be the bank.

Alice  <---- K_pub ----  ???     (But who owns K_pub?)

You can encrypt data using this key, and only its holder will be able to read it. But there is nothing to indicate that this holder is your bank. A public key is a sequence of numbers: it carries no identity.

This is a variation on the man-in-the-middle attack. And it cannot be resolved by any additional calculation: there is no mathematical property linking numbers to a real-world organisation.

Approaches that fail

Verifying each other works perfectly, and this is what messaging services do by comparing their fingerprints. But verifying every website you visit is obviously impractical.

A global directory merely shifts the problem: how do you know you’re consulting the genuine directory?

Trusting the first key you see is the solution adopted by SSH, known as TOFU (Trust On First Use). The first connection remains vulnerable, but any subsequent change triggers an alert.

The web’s solution

The web has chosen a different approach: delegating verification to a small number of organisations, known as certification authorities.

You don’t know your bank, but your system knows around a hundred certification authorities. If one of them certifies that this key does indeed belong to your bank, you accept it.

Trust is not created — it is shifted to these authorities. The whole question then becomes: how trustworthy are they?