公钥加密是如何工作的
我对 RSA 的理解是，Alice 可以创建公钥和私钥组合，然后将公钥发送给 Bob。然后鲍勃可以使用公钥加密某些内容，而爱丽丝将使用公钥和私钥组合来解密它。
但是，Alice 如何加密要发送给 Bob 的内容？鲍勃将如何解密它？我之所以这么问，是因为我很好奇当我登录银行网站时，银行如何向我发送在线报表等数据。我的浏览器如何解密该信息？我没有私钥。
What I understand about RSA is that Alice can create a public and a private key combination, and then send the public key over to Bob. And then afterward Bob can encrypt something using the public key and Alice will use the public and private key combo to decrypt it.
However, how can Alice encrypt something to be sent over to Bob? How would Bob decrypt it? I ask because I'm curious how when I log onto my banking site, my bank sends me data such as my online statements. How does my browser decrypt that information? I don't have the private key.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
基本上，该过程是：
Basically, the procedure is:
Alice 将使用公钥和私钥组合来解密Alice 将使用她的私钥对其进行解密。
但是，Alice 如何加密要发送给 Bob 的内容？ Bob 将如何解密它？Alice 需要 Bob 的公钥才能向他发送某些内容。
通常，公钥加密用于身份验证、不可否认性（如签名）和对称密钥的分发（这对于加密/解密长消息来说速度更快）。
Alice will use the public and private key combo to decrypt itAlice would just decrypt it with her private key.
However, how can Alice encrypt something to be sent over to Bob? How would Bob decrypt it?Alice would need Bob's public key to send something to him.
Typically, public key encryption is used for authentication, non-repudiation (like signing), and distribution of symmetric keys (which are faster for encrypting/ decrypting long messages).
很简单，你需要一把钥匙。
SSL/TLS 通过在连接设置期间创建对称会话密钥来解决此问题。公钥加密用于建立此会话密钥，然后将其用于双向数据通信。 了解有关 TLS 的更多信息
Simple, you need a key.
SSL/TLS solves this problem by creating a symmetric session key during the connection setup. The public key cryptography is used to establish this session key, which is then used for bi-directional data communication. Read more about TLS
这个视频不是我创作的，但有人与我分享了这个视频，它让这个理论变得更有意义。一如既往，细节决定成败（实施）。
http://www.youtube.com/watch?v=YEBfamv-_do
I didn't create this, but someone shared this video with me and it helped the theory make much more sense. As always the devil's in the details (implementation).
http://www.youtube.com/watch?v=YEBfamv-_do
总的来说，在准备 Microsoft C# 认证的同时，我花了很长一段时间努力理解公钥加密技术以及 PKI 的其他元素（例如数字签名和证书）。
我在 cgi.com 上看到了一份简明而详细的 PDF 形式的解释。我知道又回到了好心的爱丽丝和鲍勃身边！但它确实通过图表和注释为我理清了思路，最后还提出了一些发人深省的问题。绝对推荐它。
访问http://www.cgi.com/files/white-papers/cgi_whpr_35_pki_e。 pdf
On a general note I struggled to understand Public Key Cryptography for quite a while along with the other elements of PKI such as Digital Signatures and Certificates whilst preparing for Microsoft C# certification.
I came across an explanation in the form of a concise and detailed PDF at cgi.com. I know it's back to good old Alice and Bob! but it really cleared things up for me with its diagrams and notes and also has some thought provoking questions at the end. Definitely recommend it.
Visit http://www.cgi.com/files/white-papers/cgi_whpr_35_pki_e.pdf
这就是你错的地方；您确实拥有私钥。作为握手过程的一部分，每一方都会生成两个密钥：公钥和私钥。客户端将其公钥发送到服务器，服务器将使用它来加密发送到客户端的所有数据。同样，服务器生成两个密钥并将其公钥发送到客户端，客户端将使用它来加密发送到服务器的所有数据。
在许多场景中，非对称密钥算法仅用于交换另一个密钥，该密钥用于对称算法。
This is where you're wrong; you do have a private key. As part of the handshaking process, each side generates two keys: a public key and a private key. The client sends its public key to the server, who will use it to encrypt all data sent to the client. Likewise, the server generates both keys and sends its public key to the client, which will use it to encrypt all data sent to the server.
In many scenarios, the asymmetric key algorithm is used only to exchange another key, which is for a symmetric algorithm.
在这种情况下，爱丽丝将使用鲍勃的公钥来加密数据，然后鲍勃将使用他的私钥对其进行解密。
本质上，公钥加密数据，私钥解密该数据。由于每个用户都有公钥和私钥，因此您可以安全地将数据发送给任何其他用户。
In this situation, Alice would use Bob's public key to encrypt the data and Bob would then decrypt it with his private key.
Essentially, a public key encrypts data and a private key decrypts that data. Since every user has both a public and private key, you can securely send data to any other user.
如果您连接到银行的站点，它会执行很多加密操作。最重要的是，您使用银行的公钥向银行发送一条信息，因为在每个 SSL (https) 连接服务器发送到客户端时，它的公钥都打包为证书。
证书和全球 PKI 的使用很重要。您需要确保，如果您向银行提供您的银行密码，则另一方确实是您的银行，而不是其他人。这将得到解决，因为每台计算机上都有少量知名组织（例如 VeriSign）的公钥，并且银行不仅向您发送他的服务器公钥，而且还向您发送证书。例如，证书是由 VeriSign 签名的消息，其中表示“此公钥确实来自银行 XYZ”。因此，因为您有 VeriSign 的公钥，所以您可以首先验证银行的服务器证书是否正确。因此您可以确信，您与银行进行了真正的沟通。
If you connect to the site of your bank it works a lot of cryptographic things. The most important is that you use public key of the bank to send a piece of information to the bank, because in every SSL (https) connection server send to client it's public key packed as a certificate.
Usage of certificate and world wide PKI is important. You want be sure, that if you gives to the bank your bank pin, that on the other side is really your bank and not an other person. This will be solved, because on every computers there are a small number of public keys of well known organisations (like VeriSign) and bank send you not only his server public key, but a certificate. certificate is a message signed by VeriSign for example, which say "this public key is really from the bank XYZ". So because you have public key of VeriSign you can first verify, that server certificate of the bank is correct. So you can be sure, that you communicate really with your bank.