"A CA issues digital certificates that contain a public key and the identity of the owner. The matching private key is not made available publicly, but kept secret by the end user who generated the key pair. The certificate is also a confirmation or validation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users and relying parties can trust the information in the CA's certificates. CAs use a variety of standards and tests to do so. In essence, the certificate authority is responsible for saying 'Yes, this person is who they say they are, and we, the CA, certify that.'
If the user trusts the CA and can verify the CA's signature, then s/he can also assume that a certain public key does indeed belong to whoever is identified in the certificate.
Public-key cryptography can be used to encrypt data communicated between two parties. This can typically happen when a user logs on to any site that implements the HTTP Secure protocol. In this example let us suppose that the user logs on to his bank's homepage www.bank.example to do online banking. When the user opens www.bank.example homepage, he receives a public key along with all the data that his web-browser displays. The public key could be used to encrypt data from the client to the server but the safe procedure is to use it in a protocol that determines a shared symmetric encryption key; messages in such protocol are ciphered with the public key and only the bank server has the private key to read them. The rest of the communication proceeds using the new (disposable) symmetric key, so when the user enters some information to the bank's page and submits the page (sends the information back to the bank) then the data the user has entered to the page will be encrypted by his web browser. Therefore, even if someone can access the (encrypted) data that was communicated from the user to www.bank.example, such eavesdropper cannot read or decipher it.
This mechanism is only safe if the user can be sure that it is the bank that he sees in his web browser. If the user types in www.bank.example, but his communication is hi-jacked and a fake web-site (that pretends to be the bank web-site) sends the page information back to the user's browser, the fake web-page can send a fake public key to the user (for which the fake site owns a matching private key). The user will fill the form with his personal data and will submit the page. The fake web-page will get access to the user's data.
Whew! Well, if you're still with me, the point that I‘d like to make is that we all have certificate authorities in our life, and not just our digital life. As mentioned in the previous post, we have all stared squarely in the face of the question, Quid est veritas? and arrived, if not at an answer, then at least at a liveable compromise. This serves as the third party between us and whatever information or source that we encounter in the wilds of daily life. It tells us if something is true or false, reliable or dangerous, and we choose to place our faith in it because, if we're honest, it's exhausting to vet all of the deluge of information that we are inundated with on a daily basis. This is not Biblical. What is Biblical is the idea that you are to "Ask and it will be given to you; seek and you will find; knock and the door will be opened to you." In short, you are the guardian of your worldview, and you need to be aware of impostors, of will-intentioned but incorrect teachers, of fools, and of the malicious. How many of us have been compromised on Facebook, Hotmail, or had our credit card hijacked? The certificate authority failed to correctly discern the truth about our enemy's identity. The only one who can guard your worldview from corruption, by choosing your authority wisely, is you.
I realise that this will come as a no-brainer to many of you. I realise also that it is a bit of a repetition of last week's thoughts. Jesus tells us the parable of the man who built his house on a sandy foundation and suffered ruin and the other man who built on stone and found security amidst the tempest. It is my conviction that as we move forward in our study at the interface of technology, and above all social technologies, we are consistently, persistently, and constantly, faced with the Great Question of Pilate. But we must realise the error of that question, for what he needed to ask, what we all need to ask, is qui est veritas, "Who is truth?" It is for this reason that the church in bygone days made an anagram of Pilate's Great Question that answered the question itself by stating Est Vir qui adest, "It is the Man who is here."
In the next two blogs, as we look at the two great doctrines that are summarised in the person of Jesus of Nazareth, we realise that the pursuit of truth is no longer the simple establishment of a worldview that will remain as a static filter, a moral sieve contracted out to a third party certificate authority, it is rather the connection to the entirety of the Network of the Universe, the God-Man Jesus, who is not merely a passive intermediary, but rather the active imputation of Truth onto the hearts of men. To force the original analogy further, it is God Who invites us to remove any intermediary between He Who Is Truth and the "end users", not just because any other authority is unnecessary, but because it is a false authority, not to be trusted with the data of our eternality.