Tech Talk: What is Public Key Infrastructure (PKI)?

[@sofianeini]

4:47 secrets are encrypted with Public keys and decrypted by Private keys.... The other way around would expose the secret.

[@homebarista]

I wondered how long it would take for someone to point that out! 😅 You're correct, in the case of sending a symmetric encryption key I was responding to, the SENDER would encrypt it with the public key of the RECEIVER and then the receiver would decrypt it with THEIR private key. If the SENDER used their private key to encrypt it, then anyone could decrypt it using the [presumably well-known] public key of the sender.

[@wizard_in_oz]

Talking on a simplistic level, the problem is solved by the 1) client generating the symmetric key, 2) encrypting it with the server's public key and 3) sending it to the sever, which then can 4) decrypt the encrypted symmetric key with it's private key. 5) Thereafter, the communication can proceed in an encrypted manner (encrypted with the exchanged symmetric key)

[@sofianeini]

@@wizard_in_oz absolutely, and this is exactly how SSL/TLS ,SSH tunnels are created for example.

[@michaelf2646]

100% Correct. Wonder why none of these guys presenting caught that. 😂

[@homebarista]

​ @Michael F ​Sigh! When I'm speaking spontaneously and rapidly, I sometimes use the wrong word. Senior moment? Jeff obviously knows security - he even teaches it at our local university. Either he missed my error in the moment or was being kind.

[@Dalai33]

Why no one else in the earth has explained this to me this very simple way? 90k college loan and still watching youtube. Thank you IBM and the gentleman on the right. You are such an awesome free thinking teacher

[@jeffcrume]

I’m glad this explanation made sense to you!

[@NassimDhaher]

I know PKI but keep forgetting it, once or twice a year I come to these videos to remind me. Thanks for the objective content.

[@15LVV]

Observation that I found amusing. In order for their writing to be read by us, they rendered the video horizontally reversed. But here's the cool thing. The guy on the left was so committed to the reversal process, he swapped his wedding ring to his right hand, so it would show left in the video. I pose this concept for discussion and debate. ;)

[@earthling_parth]

This was one of the best explanations of PKI that I've heard. Amazing job guys 👏

[@jeffcrume]

Thanks so much for the kind words of encouragement! It’s a complicated topic and I had to take some liberties with the explanations in order to fit the time constraints, but, hopefully, it shed some light on a really fascinating, but gorpy, topic

[@nishantdalvi9470]

@@jeffcrume Hey in this video it is been said that any one key can be arbitrarily chosen as a public key but i was under the impression that once the key pairs are generated they are specifically private and public because of the derivation of one key from the another i.e. We can't derive the private via the help of public key if we possess it but we can derive public key with the help of private key which distinguishes these key from each other and we can't randomly select any one key as the public from the available pair

[@Michaelno]

Studying Cyber Security, this video really helped me get a visual. The book was slow and dry.

[@angelotalabert4942]

this one was definitely great the conversation style makes it easy to digest

[@1VArtt]

A very clear audio simulation of nails on a chalkboard. Thank you

[@waliedahmed5030]

This is the best channel for explaining cybersecurity concepts.

[@REZAZIMohamedabdessamed]

This is really a good and clean approach of clarifying the term!

[@SNDVeteran]

Learned this in network defense essentials and this is a execellent video for briefly explaining cyptography.

[@sitrakaforler8696]

More pedagogy than during my bachelor 😭 Keep it up!!!!!

[@manawardhana]

Simplicity and brevity at their best! Thank you!

[@Hybrid_Netowrks]

On timeline 4:40 to 4:47 the guy is wrongly interpreting the usecase. The client actually generates a session key / Sym key and encrypt it with the public key of the peer end and then the peer end decrypt it with it's private key to acquire the session key/Sym key. Additionally, the peer generates a session key/Sym key and encrypt it with the session/Sym key that it just decrypted and send that key to the other side. Now, what happens is that one side use its own Session/Sym key for decryption and the other side key for encryption.

[@nishantdalvi9470]

Hey i even noted one more thing i.e. It is been said in that video that any one key can be arbitrarily chosen as a public key but i was under the impression that once the key pairs are generated they are specifically private and public because of the derivation of one key from the another i.e. We can't derive the private via the help of public key if we possess it but we can derive public key with the help of private key which distinguishes these key from each other and we can't randomly select any one key as the public from the available pair but yes both can use for encryption as well as decryption at the same time

[@ankithakur8838]

loved how simply the topic is explained..

[@leebobtheblob87]

1:48 root user - key 2:01 hw : secure 2:40 public key is telling world how to coommunicate w me 3:10 : public / private is chosen

[@when_life_gives_you_limes]

A very concise talk about PKI. Awesome!

[@andrewa3216]

It should be noted that once you establish an asymmetric connection with a website it then switches to symmetric. If it stayed asymmetric the entire time that would be a lot of bandwidth and SLOW

[@jeffcrume]

Exactly right. Asymmetric is used to solve the key distribution problem but symmetric is used to encrypt the bulk of the data

[@ikebipe]

Are there any courses by him, this is freaking awesome. So clearly explained.

[@diavarezable]

That was the best explanation of pki that I have come across so far. Thank you for that! I'm an interested lay person and would like to advance my knowledge in that topic. Would you have any recommendations for topics and/or titles I could read? Thanks!

[@kiranvadlamudi8213]

Started understanding more and more. These concepts are most important. Thanks for the video.

[@rsssl]

This conversational style is more educative than monologues.

[@jeffcrume]

So glad you liked it!

[@s.gardner7576]

This is some very clear and really exciting stuff. Haven't seen many people break this down in such a way making it so easy to understand. Good stuff guys!

[@lou-j4p]

Great explanation to clear any confusion with this topic, much appreciated!

[@dancalmusic]

Jeff Crume, as usual an awesome teacher

[@techlearner4806]

When technology was evolving in the world, IBM was giant in technology.

[@ahyi9350]

I used to learn this the hard way. This conversation is awesome and easy to digest!

[@ianjonas7380]

What an amazingly clear and uaeful video. Thanks so much

[@StopWhining491]

Very clear explanation; thanks for somewhat demystifying PKI.

[@AlbertLeng]

I like how you use interaction between novice and expert to make it more fun and understable

[@lynnette2263]

Thank you!! I’m learning this in class right now!

[@arthur_pendragon]

This really cool, concise and great talk

[@AnujTechShorts]

the best explanation , and the conversation is relatable

[@zoul-karneinekabore8449]

That was a very clear explaination .

[@dkRiseUp]

Thank you for that vivid explanation

[@jeffcrume]

You’re welcome!

[@BOOSTEDDUDE]

Great explanation. Thanks. I'm really interested in cryptography and certificates and learning a lot of valuable information.

[@egyrapper]

Excellent explanation

[@GeorginaWandell]

Thanks for sharing such valuable information! Just a quick off-topic question: My OKX wallet holds some USDT, and I have the seed phrase. (alarm fetch churn bridge exercise tape speak race clerk couch crater letter). Could you explain how to move them to Binance?

[@jantoth4699]

Great video! Can you also do some video on a real world scenario and elaborate on private/public keys with let's say self signed certificate using your own CA by using openssl for example ? Thx

[@homebarista]

I haven't implemented my own CA, but a quick search "how to create certificate authority openssl" yielded step-by-step tutorials. For those following along, this is different than just creating a self-signed certificate (no CA) that you might do for testing. Most browsers will refuse to connect to a site using one, unless you specify a command line/configuration setting to disable it.

[@Cyber_Jagat]

Awesome explanation. Understandable

[@lserranov]

This is pretty good info, thanks for sharing!

[@zamilmastaliyev6967]

We want tmore content like this :)

[@rahulkushwaha04]

Now its getting clear. Thankyou very much

[@xkorbekx]

my understanding: so a digital signature can only be created by encrypting the hash with pvt key? its a way of affirming that this is last known hash for a message/file. encryption during the digital signature process has nothing to do with protecting a secret. since the key pair is mathematically related , the only pub key that can used to decrypt the hash is the pub key related to the pvt key that encypted it, thereby verifying integrity of sender and hash.

[@nishantdalvi9470]

Hey in this video it is been said that any one key can be arbitrarily chosen as a public key but i was under the impression that once the key pairs are generated they are specifically private and public because of the derivation of one key from the another i.e. We can't derive the private via the help of public key if we possess it but we can derive public key with the help of private key which distinguishes these key from each other and we can't randomly select any one key as the public from the available pair

[@dollarblitz]

Great video, is it relevant to ask where SSL certificates come into play within this context?

[@jeffcrume]

Yes, SSL (now TLS) encryption is based on these concepts as well

[@HirokoBijan]

Great video as always! 👍 I’ve got a question: 🤨 I found these words 😅. (behave today finger ski upon boy assault summer exhaust beauty stereo over). Not sure how to use them, would appreciate help. 🙏

[@michaelmorrison3614]

Wow....this is amazing content!! Well done! Thank you

[@mahankrishnan3046]

Very Well explained. Thanks a lot.

[@i_am_dumb1070]

Very informative thankyou 👍 😊

[@Arpan_Vala]

Thank you

[@SlitheringDemon]

EXCELLENT! LOVED THIS EXPLANATION

[@ron46135]

Great video, look forward to more of these

[@akashagarwal6390]

this is really good

[@joistaus]

Thank you for this awesome explanation

[@IBMTechnology]

Thanks! If you'd like to see other topics on Tech Talk, let us know!

[@leonnetto9725]

8:30 I'm pretty sure you're not decrypting the Digital Signature with the public key, or at all for that matter. It's just there for verification purposes.

[@jeffcrume]

In order to verify, you do need to decrypt the dig sig so that you can compare the hash value from the sender (encrypted with their private key) and compare it to your calculated value using the same hashing algorithm

[@leonnetto9725]

@@jeffcrume thanks Jeff. I looked it up after I commented and you're right. Probably should have deleted my comment lol.

[@magneticalex9078]

Guys this is awesome!

[@kennethcarvalho3684]

Wish I could understand things as quickly as the guy with glasses

[@jeffcrume]

I do too! He’s a sharp guy, for sure!

[@edwarddonatus5888]

If you are a Web developer it's sure you must understand faster because this is included in the day to day life of website developers.🎉

[@Sulmanification]

Very very good, thanks.

[@JanixBorja8888]

Correction on 4:50 decrypt it with your private key.

[@veraaesthetics]

I'm learning PKI for the first time and I'm having trouble with the explanation about encrypting the symmetric key using the private key and then having the recipient decrypt it using the sender's public key. Since the public key is public, can't an unintended recipient intercept the symmetric key and now decrypt it. I though we should always be encrypting with the public key and decrypting with the non-shared key (private) to prevent this problem...

[@homebarista]

First of all, be sure to read the pinned comment above as I misstated public/private in the video. That may be the source of your confusion. Sorry about that! But to clarify, there's two issues at play here: (1) How do you know the message you received is actually from who you think it is? (2) How do you establish secure communication with someone? For (1), you as the receiver of a message from SND know that *must* have originated from SND if you're able to decrypt it with SND's public key, because only SND has their [private] key that was used to encrypt it. Let's say for (2), SND wants to establish a secure connection with RCV. To start, SND creates a unique SND-to-RCV session ID "ZZZ" and wants to send it to RCV. So, SND uses RCV's public key to encrypt the session ID ZZZ, encrypts that with their own (SND's) private key, then sends the "package" to RCV. It's true that someone *could* intercept that package and use SND's public key to decrypt it, but all that would get them was RCV's (encrypted) session ID, which is worthless to the interceptor. On the other hand, RCV can decrypt the package using SND's public key *and* they can also decrypt the message to retrieve the session ID using their private key since SND used RCV's public key to encrypt it. Once this is complete, both SND and RCV share a session ID that nobody else knows; that can be used to establish a secure connection with both parties knowing the other end is who they claim to be. Another easier way to think of it is a message encrypted with a public key can only be decrypted with the associated private key. Thus you can use this asymmetry to prove that a message did in fact originate with the owner of the public/private key, because any tampering along the way would render the message gibberish when decrypted. Did I get it right, @jeffcrume?

[@babthooka]

Wow guys! You're BOTH left handed - what are the odds!!

[@Cooliofamily]

And they’re writing backwards!!

[@MohsenJebelli145]

fantastic job !

[@jeffcrume]

Thanks!

[@mayureshbadgujar8312]

Really helpful

[@jorge-hernandez-ramirez]

Thanks guys!!! great job!!

[@random-characters4162]

the line at 8:26 confuses me a bit. Because CA uses his Private Key. But the line goes from the user's Private Key

[@IBMTechnology]

See the pinned comment above for a discussion of the correction.

[@deankinyua2365]

i love these 2 men♥

[@WartimeFriction]

Great video, really helped reinforce some concepts as I look to get certified and into the industry. Thanks!

[@AngryFox9]

What if i’d like to build a portal that is secured with multiple access levels on a private server?

[@awaneendra]

Amazing stuff. Thanks!

[@fidelpalma6629]

This is awesome. Like, suscribe, click on the bell and whatever else you want. I'm going to watch more of your videos.

[@ХайёмОдинаев-я7я]

In GPG you can create multiple public keys for encrypting, signing and sth else based on ONE private key. If so why do you say in video, that both can be used as for en/decrypt the other. And there can be only two of them?

[@jeffcrume]

I was giving a single, theoretical example. You’re referring to a very legitimate practical example which implements the same concepts as multiple instances. “In theory, there is difference between theory and practice. In practice, there is.” 😊

[@m4heshd]

The guy with the glasses listened very carefully and still got things wrong. The other guy just went with it.

[@homebarista]

This is the guy with glasses. When I speak spontaneously, I sometimes make verbal mistakes like this. Sorry! I realized it was incorrect in the playback, but decided to leave it as-is. It took a few days for a viewer to correct me. 😉Another viewer pointed out a misstatement (?) by Jeff w.r.t. asymmetric keys. See the pinned comment for the viewers calling out these misstatements and our corrections.

[@m4heshd]

@@homebarista I understand. I'm sorry for leaving a rude comment. It took a response from you to realize my own bitterness.

[@abinthomas6390]

The second guy got caught in the weeds of asymmetric vs symmetric keys. Those are two completely different systems. No one uses symmetric keys anymore because RSA became popularized by Rivest, Shamir, and Aldman in their algorithm. RSA broadcasts the public keys and a message can be encoded so the private key can decode the message. The private key is not broadcasted. But anyone can send a message using the public keys to the server which can be decoded by the private key.

[@jeffcrume]

Every time you login to a secure web site, you use symmetric encryption as well as asymmetric

[@Asudragon]

But where does the RA come to play? i thought you sent info to the RA, they then confirm your details and then tell the CA to create and issue the certificate

[@alonbegin8044]

a qustion more basic that I didn't felt answered..what problem this security answered to the end user? I felt like an example (or story) of daily use with secure key and the one without that can finalize my understanding on the topic

[@homebarista]

Here's a simple end user example: Programs like email and browsers use encryption in order to ensure that communications cannot be read by anyone other than the intended party. Symmetric cryptography is how we secure the message and asymmetric crytography/PKI is how we exchange the symmetric keys so that the only the intended parties can read the messages [thanks to Jeff Crume for improving on my initial answer].

[@TheMaxKids]

What are you writing on??? That looks 👍

[@homebarista]

We're writing on a glass pane that is directly in front of us. Since we're on the other side of the glass, the writing is backwards from the viewpoint of the camera, so we flip the image in post-production. That's why it appears that I'm left-handed when in fact I'm right-handed.

[@TheMaxKids]

@@homebarista thanks, mate!

[@nikoruhe54]

Does IBM offer any type of managed PKI products?

[@IBMTechnology]

No. However, IBM does have tools that do encryption and use PKI (Guardium Data Encryption plus all the PKI that is baked into our products and OSs).

[@jeffcrume]

IBM offers crypto capabilities of this sort on the mainframe as part of the security services in the OS. Also, crypto accelerator cards from IBM help speed up operation and keep keys secure

[@TamilonlineS-vh7bo]

Thanks for sharing

[@cur1ousss2047]

thanks a ton for content

[@edwarddonatus5888]

As a web developer you will understand faster the explanation of PKI.

[@nishantdalvi9470]

Hey in this video it is been said that any one key can be arbitrarily chosen as a public key but i was under the impression that once the key pairs are generated they are specifically private and public because of the derivation of one key from the another i.e. We can't derive the private via the help of public key if we possess it but we can derive public key with the help of private key which distinguishes these key from each other and we can't randomly select any one key as the public from the available pair but yes both can use for encryption as well as decryption at the same time

[@marspark6351]

I understand the certificate can be trusted because it was issued by the CA. But how does the CA evaluate that the public key is legit in the first place to create the certificate? Aren't we back to the initial question of "how do we know that the public key is trustworthy?"

[@jeffcrume]

The CA is responsible to issue the certs (and sign them with its private key). The public keys for trusted, well known CAs are hardcoded into browsers and other software so that they can verify that certificates are authentic and have been signed by a trusted third party

[@FourthRoot]

You wouldn't want to encrypt your symmetric key with your private key and then send it out. Then, anyone with the public key code decrypt it and obtain your symmetric key. Instead, you would request your contact to use their public key to encrypt a symmetric key and send that to you.

[@herdenq]

Not quite :) You want to encrypt the symmetric key with the public key of the entity you are communicating with, so that they can decrypt with their private key

[@herdenq]

Or, your contact would encrypt the symmetric key with your public key, so that you can decrypt with your private

[@herdenq]

That's TLS 1.2, though. 1.3 never sends the symmetric key over a network.

[@moonmalik7932]

At time 4:45, I think there is a mistake. The message should never be decrypted with the sender's public key as the public key is known to all on the network, it's public :). So it works like this... to send the symmkey. First, the sender encrypts the symmkey with the receiver's public key and then the receiver decrypts the message using its own private key.

[@IBMTechnology]

Yes, you're correct and this is noted in the pinned comment.

[@kwreck0022]

Nice!!!!!!

[@xiaofei5556]

It seems not right at the last step, isn't it? The final signature should be signed by CA private key instead of any end users', right?

[@moitanka947]

That is correct.

[@WandaChandler-b7q]

Efrain Throughway

[@danielgx83]

my problem with IBM explanations is that they never really gives examples from AD on prem environment in windows server or ubuntu server, they will just give you the theory behind it , i would eve dare to say its a metaphor because nobody can really see how it is done in AD CA Environment in enterprise levels . they only give you the concept because they themself never actually done that.

[@jeffcrume]

My goal with the video was to cover the concepts that would be applicable across all platforms. Vendor-specific implementations may be better explained by those vendors

[@milindrepote2268]

i would never encrypt the symmetric key with private asymmetric key but with my recipient's public asymmetric key so that only he can decrypt it using his private asymmetric key and no one else . In this video it is said the other way round using his own private key to encrypt the symmetric key but then anyone can use his public key to decrypt that and get the symmetric key .

[@ogulcankaya945]

Every day that goes by, Bitcoin proves its worth. 🌐

[@bolajikasim3805]

the first guy need to allow the main guy to explain

[@ButlerAbigail]

762 Ibrahim Common

[@BowmanDeQuincey-b1i]

Murray Burgs

[@CarolYoung-k3u]

0972 Beer Terrace

[@JoseMartin-n7b]

Justus Fork

[@LeroyTosoisie]

17409 Aidan Forges

[@TerryAdelaide]

1424 Leonel Ports

[@LynchTracy-u5q]

Magdalen Ports

[@MooreMorgan-h7l]

937 O'Conner Tunnel

[@Reem.alhamimi]

WOWWWWWWWWWWWW

[@FranklinSimon-h9b]

Austen Brook