Sharing Information Securely

In "Keep Your Secrets Safe" (August 2005, InstantDoc ID 46871), I introduced you to shared key and public/private key encryption. I pointed out that shared key encryption is good for bulk encryption of large amounts of data, that public/private key encryption is better for exchanging information between parties, and that you can combine the two to get the best of both worlds. I also discussed how you can combine public/private key encryption with hashing to create digital signatures that prove both the identity of a message's sender and that the data wasn't altered since it was signed. Public/private key encryption is a versatile and effective way to prove identity and share secure information between parties that might not know each other. But here's one important caveat: Users must have a way of obtaining other users' public keys and be fully confident that a user's public key really is the user's and not an impostor's. To ensure that confidence, an infrastructure that facilitates the publishing of public keys is necessary. The good news is that such technology exists. It's called public key infrastructure (PKI). . . .