PKI Fundamentals
Public Key Infrastructure (PKI) is the framework of policies, procedures, hardware, software, and roles for creating, managing, distributing, and revoking digital certificates. It enables secure communication through public/private key pairs.
Understanding PKI Fundamentals
Public Key Infrastructure (PKI) is the ecosystem that makes secure digital communication possible. It's how your browser knows a website is legitimate, how you can send encrypted email, and how digital signatures prove authenticity.
At its core, PKI uses key pairs—mathematically linked public and private keys: • Public key — Shared openly, used by others to encrypt data for you or verify your signature • Private key — Kept secret, used to decrypt data or create signatures
PKI solves a fundamental problem: how do you securely communicate with someone you've never met? By establishing trust through certificates issued by trusted authorities, PKI enables secure communication between strangers across the internet.
Why This Matters for the Exam
PKI appears throughout SY0-701, connecting cryptography, authentication, and network security. Understanding PKI fundamentals is essential for grasping digital signatures, TLS/SSL, certificate management, and many other exam topics.
The exam tests both conceptual understanding (how keys relate) and practical knowledge (what each key does). Questions often present scenarios asking which key to use for encryption versus signing, or what happens if a private key is compromised.
Real-world, PKI underlies nearly all internet security. HTTPS, email encryption, code signing, VPNs, and digital signatures all depend on PKI.
Deep Dive
The Key Pair Relationship
Public and private keys are mathematically linked: • Generated together as a pair • What one encrypts, only the other can decrypt • Cannot derive private key from public key • Compromise of private key breaks all security
Public Key Uses:
- •Encrypt data so only the private key holder can read it
- •Verify signatures created by the corresponding private key
- •Shared freely without security risk
Private Key Uses:
- •Decrypt data encrypted with the corresponding public key
- •Create digital signatures that prove identity
- •Must be kept absolutely secret
The Two Directions of Asymmetric Cryptography
| Operation | Key Used | Purpose | Who Can Do It |
|---|---|---|---|
| Encrypt | Public | Confidentiality | Anyone with public key |
| Decrypt | Private | Read encrypted data | Only private key holder |
| Sign | Private | Non-repudiation | Only private key holder |
| Verify | Public | Confirm signature | Anyone with public key |
PKI Components
Certificate Authority (CA)
- •Issues digital certificates
- •Verifies identity before issuing
- •Maintains certificate revocation lists
- •Root of trust in the system
Registration Authority (RA)
- •Handles certificate requests
- •Verifies applicant identity
- •Forwards approved requests to CA
Digital Certificates
- •Bind identity to public key
- •Signed by Certificate Authority
- •Contain expiration date
- •Can be revoked if compromised
Key Escrow
Key escrow means a copy of a private key is held by a third party.
Purposes:
- •Business continuity (access data if employee leaves)
- •Legal compliance (government access requirements)
- •Disaster recovery (key recovery)
Concerns:
- •Creates additional attack target
- •Trust in escrow agent required
- •Privacy implications
Trust Models
| Model | Description | Use Case |
|---|---|---|
| Hierarchical | Single root CA, trust flows down | Web PKI, enterprise |
| Mesh/Web of Trust | Users vouch for each other | PGP email encryption |
| Bridge | Connects different PKI hierarchies | Government, cross-org |
How CompTIA Tests This
Example Analysis
Scenario: Alice wants to send a confidential message to Bob that only Bob can read, and Bob needs to verify the message came from Alice.
Solution using PKI:
For Confidentiality: • Alice encrypts with Bob's public key • Only Bob's private key can decrypt • Anyone can send TO Bob securely
For Authentication/Non-repudiation: • Alice signs with her private key • Bob verifies with Alice's public key • Proves Alice sent it
Key insight: Notice the key directions—encrypt with RECIPIENT's public key, sign with SENDER's private key. This is the most commonly tested PKI concept.
Key Terms to Know
Common Mistakes to Avoid
Exam Tips
Memory Trick
"PRiVate Signs, PUBlic Verifies"
- •PRIvate key = PRIvate signature (you sign)
- •PUBlic key = PUBlic verification (others verify)
- •Encryption Direction:
- •Sending TO someone? Use THEIR public key
- •Reading what was sent? Use YOUR private key
- •The Lock and Key Analogy:
- •Public key = Padlock (anyone can lock/encrypt)
- •Private key = Key to padlock (only owner can unlock/decrypt)
- •PKI Components: "CARD"
- •Certificate Authority (issues certs)
- •Attributes (in certificates)
- •Registration Authority (verifies identity)
- •Digital certificates (bind identity to key)
Test Your Knowledge
Q1.Alice wants to send an encrypted message that only Bob can read. Which key should Alice use to encrypt the message?
Q2.An organization requires the ability to recover encrypted data if an employee leaves or loses their key. What PKI feature addresses this need?
Q3.What is the PRIMARY security concern if a private key is compromised?
Want more practice with instant AI feedback?
Practice with AIContinue Learning
Ready to test your knowledge?
Practice questions on pki fundamentals and other Objective 1.4 concepts.