数字签名安全模型中如何保证公钥来自发送者？
我读了一篇关于数字签名的文章（链接）并有以下问题。
假设爱丽丝想向鲍勃发送消息。她需要让鲍勃知道该消息是她发来的。因此，她用私钥将散列消息加密成证书。然后Bob在收到消息时可以用公钥解密该消息。如果消息的哈希码与从证书中解密的哈希码匹配，Bob 就可以知道它来自 Alice。这里我们假设鲍勃已经知道公钥。如果公钥的传输已经受到攻击怎么办？鲍勃可能使用错误的公钥来解密错误的消息，并从爱丽丝那里获取该消息。是否有任何协议或策略来避免对公钥的攻击？我们呢？
I read an article about digital signature (link) and have question as follows.
Let's say Alice wants to send a message to Bob. She need to let Bob know the message is from her. So she encrypted the hashed message with her private key into a certificate. Then Bob can decrypted the message with public key when receiving it. Bob can know it is from Alice if the hash code of the message matches the hash code which is decrypted from certificate. Here we have the assumption that Bob already knows the public key. What if the transmission of public key is already attacked? Bob might use the wrong public key to decrypt the wrong message and get that the message if from Alice. Is there any protocal or policy to avoid the attack against public key? And shall we？
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，公钥的真实性是应用密码学的关键组成部分。我可以发布一个公钥，上面写着“我是你们银行的网站，相信我”，但你不应该真正信任它。已经开发了不同的方案来建立公钥认证。一种方法是 PGP 和 GnuPG 中的信任网络模型，其他方法是PKI 和 Kerberos。这些方法之间的主要区别之一是您信任的地方。我仅提供简化的描述，您必须阅读它们才能了解确切的详细信息（您不会将您的安全性建立在极其简短的摘要之上，不是吗？）。
在信任网络中，有一些您信任的人，并且您（理想情况下）亲自验证了他们的公钥。如果其他公钥是由您最初信任的多个人签署的，您可以信任其他公钥。使用这些值得信赖的个人，您可以检查越来越多的密钥。
在PKI（个人密钥基础设施）中，您信任多个证书颁发机构 (CA) 并接受他们的公钥。您相信他们在签署公钥之前会彻底检查密钥持有者的身份。公钥+来自 CA 的签名（以及一些其他数据）的组合形成证书。 PKI 用于SSL/TLS，它是安全网络的底层基础设施。当您在网络界面上阅读邮件、进行网上银行等时，您会使用它。如果 CA 被泄露，那么该 CA 签署的每个证书都将变得不安全。
Kerberos 是为计算机网络设计的，密钥服务器 是单点信任。它为客户端和服务器提供相互身份验证和唯一的对称加密密钥。密钥服务器通过仅在密钥服务器和客户端之间共享的秘密来检查客户端的身份。例如，Kereberos 用于 Windows、AFS、网格计算。
Yes, the authenticity of public keys is a key component of applied cryptography. I can issue a public key that says "I am the website of your bank, trust me", but you shouldn't really trust it. Different schemes have been developed to establish authentication of public keys. One approach is the web of trust model in PGP and GnuPG, others are PKI and Kerberos. One of the main difference between these approaches is where you place your trust. I provide a simplified description only, you have to read about them to learn about the exact details (you wouldn't base your security on an extremely short summary, would you?).
In the web of trust there are some people who you trust, and you (ideally) verified their public keys personally. You can trust other public keys if they have been signed by several people bearing your initial trust. Using these trusted individuals you can check more and more keys.
In PKI (Personal Key Infrastructure) you trust several Certificate Authorities (CAs) and accept their public keys. You trust them that they thoroughly check the identity of key holders before signing their public keys. The combination of public key + signature from a CA (and some other data) forms a certificate. The PKI is used in SSL/TLS, it is the underlying infrastructure of the secure web. You use it when you read your mail on a web interface, when you do online banking, etc. If a CA is compromised, then every certificate signed by the CA will be come insecure.
In Kerberos is designed for computer networks and the key server is the single point of trust. It provides mutual authentication and a unique symmetric encryption key for clients and servers. The key server checks the identity of clients by a secret shared only between the key server and the client. Kereberos is used, for example, in Windows, AFS, Grid computing.
你的回答让我对这个问题有了很多了解。另外，我想放置维基百科链接 http://en.wikipedia.org/ wiki/X.509#Security 此处。因为文章中有一句话解决了我的问题“谁对证书颁发机构进行了认证”
以防万一有人有同样的问题。
your answer gave me much of insight into the question. And also, I would like to put the wikipedia link http://en.wikipedia.org/wiki/X.509#Security here. Coz there is one stentence in the article solve my question "who certificate the Certificate Authority"
Just in case some one has the same question.