uh my talk is about certificate and the
pki which is public key infrastructure
um it's usually hard um and from kind of
anecdotal like evidence i know a lot of
smart people who've avoided this
particular rabbit hole for a whole long
time
and prior to my current role i've
avoided this as well you know and felt
the some shame for not knowing more the
obvious result was this vicious cycle i
was too embarrassed to ask questions so
i never learned
eventually i was forced to learn
uh the stuff because i joined well a pki
open or
open core company called small step
uh check us out you know open source
stuff on github
github.comsmallstep.com but you know i
really wish that i learned all this
stuff sooner would have helped my career
when i was working heavily in the
service mesh space and network
connectivity with proxies so let's dive
into the how and the whys for pkis so
jeff if you could do next slide for me
please
yeah so you know before i get started
here's a brief intro my name is kevin i
work as a developer advocate at
smallstep and focusing primarily on
building out our open source toolkit and
community
i really like to nap so this photo
really captures me in my natural state
um so you know if you saw me at defcon
in person over these past three days you
know i was probably the one passed out
in the corner i meant to say hi but i'm
sorry
all right next slide here
um
[Music]
what okay
more problems all right we're just gonna
jeff do you want to just let's just
yeah we'll just use my face as the main
screen it's okay pkis i can make this
fun without slides because honestly
slides make things more boring anyways
right so back to
um fundamentally the math is complicated
and my i'm terrible at math but the core
concepts are really really simple and
i'm going to try to make them as simple
as possible
um to simplify things right certificates
are a way we identify code and devices
and identity is super useful especially
in this kind of distributed
architecture age for stuff like security
monitoring metrics million other things
and using certificates not hard but
before we can even talk about the
certificates we want to use we have to
talk about signatures
signatures as in digital signatures are
really a lot like the physical world
signatures that you know we use they are
used to verify who sent a message
and they use in the digital space public
key cryptography or asymmetric
cryptography we don't do that in real
life thank god it would be a pain in the
butt
so what it lets you do is that you can
prove that someone knows
their private key the private key
without knowing the private key yourself
how does this work let's kind of use
example right you can use a public key
to prove someone knows their private key
and that becomes really important for
authentication you know which is really
what most people are using certificates
for proving who sent a message
uh because you know to you to generate a
certificate you uh you need a private
key but to verify signature you only
need the public key and you can't
generate a signature using the public
key only the private key right keep that
in mind there's two set of keys and this
key pair is really really important for
signatures
so i might be the only person who knows
a particular private key and all of you
my audience if you all knew my publicly
i can sign something and you all can
verify the signature
and you can know that the only way the
signature was produced is because me uh
is by me because i'm the only one who
holds the private key
another example we talked about you know
from another perspective let's say
there's an audience member called cindy
right i know cindy's public key
uh i can know if i'm actually talking to
cindy by using this kind of key pair the
way i might do that is just to generate
let's say random big big number
uh and say and tell cindy hey cindy
please sign this for me
if the number is big enough it's very
very unlikely that anyone has produced a
signature over this random number that i
generated
so if i get a signature over that random
number back that verifies i basically
challenged cindy and got a response for
her knowing that okay i'm talking to the
right person
uh this is you know the core of how
certificate based authentication works
um it's just using this kind of key pair
signing protocol the math is complicated
we're not gonna dive into it you can
easily search on your own if you're more
interested but you know if you want to
use certificates that's really all you
have to know
um
let's see so that's the easiest way i
can really boil down certificate based
authentication with uh asymmetric
cryptography to authenticate a personal
device or whatnot
but there is a problem right that we
need to address
to authenticate someone you need to know
their public key so
if you're talking to a lot of people
you're going to need to know the public
key of every single person
and the second problem that kind of
follows that is the way you learn the
public key has to be secure
right if we go back to the cindy example
if someone lied to me right and they say
tell me that cindy's public key is x y z
uh but instead of telling their public
key they actually use their own public
key right
they can pretend to be cindy
because now i'm confused about what
cindy's public key actually is so if you
have a lot of people like you have to
talk to a lot of people or more commonly
you know as you know architects of big
systems we're talking about like big
systems we have a lot of components
talking to each other right not
necessarily people
every component needs to know every
other components publicly
publicly
and that can be really challenging and
we have to do that in a secure manner
and this is where certificates enter the
picture
and certificates can be intimidating but
fundamentally also really simple and
here's my kind of eli five example like
explain like on five
definition certificates are like
driver's license right we all have them
they are driver's license or passports
you know for your computer encode if
you've never met me before and you trust
the dmv
you can use my license for
authentication you can verify that
license is valid you can look at my
photo here read my name you know it says
kevin
computers use certificates to do the
exact same thing
if you've never met some computer before
you can trust the same certificate
authority aka you know the dmv uh and
you can use the certificate for
authentication verifying that the
certificate is valid based on their
signature look at their public key
reading their names etc right
so essentially a certificate is a data
structure much like our id that binds a
name to a public key
the purpose is to learn someone's public
key if you don't already know it
and then we have to go back how does
this solve the whole secure problem of
learning people's public key well this
is where the dmv or in the digital space
our certificate authority comes into
play
if you can trust the certificate
authority which is what signs
certificates
you can trust what cindy
is and who she says she is
and we can dive a little deeper into our
our certificate you'll see it's you know
represented by bits and bytes this part
is actually you know annoyingly
complicated in fact i i suspect that
the poorly defined manner in which
certificates and keys are encoded is
probably the source of most confusions
at least i can say most of my confusion
and frustration when i approach pkis at
the start but just know that when people
talk about certificates usually without
any additional qualifications
they're referring to the x 509 b3
certificate
and to make this more relatable they're
referring to some the sort of
certificate that browsers understand and
use for https which is http over tls
there are obviously other certificate
formats notably the ssh and gpg
both have their own
but we're going to focus on the x 509
for the remainder of the talk if you can
understand x 509 you'll figure out
you'll be able to figure out everything
else by yourself
and since these certificates are x509s
are so broadly supported they have you
know you can trust that there's a good
amount of libraries that you know
support them and they use in a lot of
different contexts
all right let me check on time
i'm here i'm the time keeper and guess
what you've got two minutes my friend oh
boy technically all right let's let's
let's speed things to right okay so
x79 was actually blah blah blah i'm
going to skip through this little fun
tidbit it was created back in like the
1980s for phone books you know you don't
really need to know that but what what i
want to get into is that pki is really
the umbrella term for all the stuff
right the issue distributes store use
and verify revoke uh and interact with
certificate and keys
a vague like database infrastructure
because it really encompasses a lot and
you know stuff like the jobs the
protocols conventions clients and
servers
cron jobs what not but just know that
the pki kind of encompasses this kind of
signature
certificate signing kind of space
all right skip through the build your
own versus buy i would advocate by using
open source for to start
and blah blah blah sorry to skip a punch
all right so let's let's get back here
to uh web tki's okay so what pki uses
you know
x509 and the beauty about you know
there's two kind of pkis is that there
is the web pca which is what you're
commonly familiar with but there's also
something that i want to advocate for
and what my talk is really about is
internal pkis
internal pki is what you run for your
own stuff production infrastructure like
services containers and vms uh corporate
endpoints stuff that you know you don't
want to rely on a web pki for because
you're running an internal pki gives you
a lot more control and flexibility it
allows you to authenticate and
establish channels on your own stuff to
run like secure communications
anywhere and you know the problem is
that the web pci was not designed to
support internal use cases right the
last thing i want to mention is that
even with a ca like let's encrypt which
offer free certificates and automated
provisioning you still have to deal with
stuff like rate limit and availability
uh additionally
uh web key guys
by default have a lot of trusted cas so
do you really want your you know your
your internal like services and devices
to
be authenticated based off uh external
cias that are run by other orgs and
located perhaps in countries that you
don't trust as much or just outside your
own like infrastructure
so
what i want to kind of sum up is
use your own like run your own internal
pki sorry for not getting screen share
to work and having to rush through this
check out github you know there is a lot
of open source scenarios small step is a
great one and you can hear let me write
i think i read that yeah if you have any
questions go to kevin you can email me
at kevin at smallstep.com
or you can find me on twitter at dev
avocado which is you know
right there dab cut out i'll i'll put
this in like the comment section
jeff back to you we try