The last piece of the cryptography puzzle is a system for establishing the identity of people who hold cryptographic keys. In recent years, such a system has come to be called the public key infrastructure, as we discussed in Chapter 6.

Recall that public key encryption systems require that each user creates two keys:

While secret keys are designed to be kept secret, public keys are designed to be published and widely distributed.

Schematically, you might imagine that public and secret keys contain little information other than the actual values that are needed for public key encryption and decryption, as shown in Figure 10.4.

Figure 10-4.  A simplistic idea for storing public and secret keys

It turns out, though, that we need to store more information with each public key. In addition to the encryption information, we may wish to store the user’s name (see Figure 10.5) or some other kind of identifying information. Otherwise, if we had public keys for three people—say, Sascha, Wendy, and Jonathan—there would be no easy way to tell them apart. And we need to store more information with each secret key, so we have a way of telling which secret key belongs to which public key.

Figure 10-5.  A better representation for public and secret keys, containing space for the user’s name

The name field can contain anything that the key holder wishes. It might contain. “Sascha Strathmore.” Or it might contain “S. Strathmore” or “Ahcsas Obsidian” or even “Head Honcho”. Once the key is created with a name, it can be signed by a third party. Third parties that verify the information on the key before it is signed are called certification authorities; these are described in detail in Chapter 7.