Authentication in Pretty Good Privacy Confusions

[shivajikobardan]

We want authentication ie
-> the source written in the received message should be the actual real source that sent the message.
->information should not be altered in the way (data integrity)

So to support this, book does this.

But I can’t realize how it is helping authentication? How do we know the source in the received message is actual source? (You might say by comparing the received hash and computed hash of received email message) but that I can’t feel it how.

Leaving PGP aside, What is the best way in real life to know that the message is sent to me by someone whom I know? Maybe if we have some well established secret code between us.

authentication means-:

1) when information is received from a source, authentication means that source is indeed as alleged in the information.
2) information was not altered along the way. this authentication is also referred to as maintaining data integrity.

RSA at sender-:
with sender's private key

My genuine questions(I am aware about symmetric and assymetric encryption-here the text explicity said public key for encryption and private key for decryption. Any scientific reason behind that)

{ Why not use sender's public key here?
Why not use receiver's private key here?
Why not use receiver's public key here?
}

RSA at receiver-:
with sender's public key.


{ Why not use sender's private key here?
Why not use receiver's private key here?
Why not use receiver's public key here?
}

 

[JeffM]

As I said in response to a previous question of yours, I have not worked with computers professionally in fifty years, but you seem to be losing track of the forest for the trees.

The sender cannot use the receiver’s private key because the sender should not know it.

The whole private-public key process works by encrypting using the private key. So encrypting using the private key is what assures that the message did originate with the sender. The hashing provides reasonable assurance that the message was not altered en route.

 

[blamocur]

But I can’t realize how it is helping authentication? How do we know the source in the received message is actual source?

How do you know that the message comes from, say, Bob? You do because you are using Bob's public key to decode the signature, and only Bob could encode it because only he knows his private key. (The signature here is the encrypted SHA hash of the message).

{ Why not use sender's public key here?
Why not use receiver's private key here?
Why not use receiver's public key here?
}

When you ask "Why not use ..." you need to come up with a more specific protocol/scenario which we can then look at and see if it would work or not.

 

[Rosielily]

As I said in response to a previous question of yours, I have not worked with computers professionally in fifty years, but you seem to be losing track of the forest for the trees.

The sender cannot use the receiver’s private key because the sender should not know it.

The whole private-public key process works by encrypting using the private key. So encrypting using the private key is what assures that the message did originate with the sender. The hashing provides reasonable assurance that the message was not altered en route.

yes,The sending and receiving computers change public keys with everyone via a reliable channel,. The private keys are never exchanged.

 

[shivajikobardan]

As I said in response to a previous question of yours, I have not worked with computers professionally in fifty years, but you seem to be losing track of the forest for the trees.

The sender cannot use the receiver’s private key because the sender should not know it.

The whole private-public key process works by encrypting using the private key. So encrypting using the private key is what assures that the message did originate with the sender. The hashing provides reasonable assurance that the message was not altered en route.

yeah i learnt it just after asking this question. i understand 50% of my doubts answers after asking questions in forum like this. it clears my thought process.(it is not like i don't prepare before asking question, first i clearly write my doubts in google drive and word it properly then only ask).