Calculate your site FeedRank Today
FeedRank, a newly developed algorithm for ranking RSS feeds only on RSSMicro
Click here to learn more
 6/10 Very Good --- feeds.macuser.com http://feeds.macuser.com/macuser
| News, info, and opinion by Mac users, for Mac users. ... |
Thursday, May 15, 2008 --- 70 days ago http://feeds.macuser.com/~r/macuser/~3/290149197/apple_updates_pgp_key.php
 Apple authenticates itself to users using a PGP key and updates it every two years. I’ve probably written about this before, but the quick version is that authentication security is based on asymmetric keys. In other words, pairs of keys are used, one public and one private. Apple holds onto the private one not telling it to anyone. The public one is listed here . The key (pun unintended) of this is that something encrypted one key can be unencrypted by the other.
By encrypting a message (or some version thereof, like a hashed version) using the private key, we can check that Apple sent the message by decrypting with the public key. If the two match up, Apple wrote it. No one but Apple knows the private key, therefore if the public key decrypts it, Apple must have written it.
Now, given enough time, brute force methods could discover the private key (how long is up to theorists to decide). Therefore, Apple spawns a new key pair every two years, effectively removing that threat. Apple puts the new public key on its website (which we have an expectation that it isn’t hacked) and sends it out in email, authenticating it with the old key (making that the final use). Now you can verify those security mailing list messages from Apple and know why it works. Don’t you feel better?
Primary category: Security
Read
- Comments (0)
Copyright Mac Publishing LLC. This RSS feed is for personal non-commerc ... |
|
|
Recent Posts
|
|
|
Facebook Del.icio.us Digg StumbleUpon Reddit Google
Anytime
