A's User B decodes ciphertext with plaintext Private Key user B's private key User A encrypts plaintext with user B's public key and encrypts hash value with user A's private key User A's Public Key User B compares User B decodes hash value User B hashes computed hash value with user A's public key plaintext with decoded hash value Figure 9.27 Encryption and authentication Public key management involves the exchange of secrets that both ends use to produce random short-term session keys for authenticating each other. It is a method of encrypting data by using two separate keys or codes. The sender uses a public key generally provided as part of a certificate issued by a CA to scramble data for transmission. The receiver then uses the corresponding private key to decrypt the data upon receipt. The CA issues certificates that contain data about individuals or enterprises that has been verified to be authentic (although not all public CAs do this). In essence, the CA vouches for the authenticity of other par- ties SO that their communications are secured. Message authentication verifies the integrity of an electronic message and also verifies that an electronic message was sent by a particular entity. Before an outgo- ing message is encrypted, a cryptographic hash function-which is like an elabo- rate version of a checksum-is performed on it. The hash function compresses the bits of the plaintext message into a fixed-size digest, or hash value, of 128 or more bits. It is then extremely difficult to alter the plaintext message without invalidat- ing the hash value. Message authentication mechanisms include Message Digest-5 (MD5) and Secure Hash Algorithm-1 (SHA-1). MD5 hashes a file of arbitrary length into a 128-bit value. SHA-1 hashes a file of arbitrary length into a 160-bit value; it is more processor intensive, but it renders greater security. Public key management provides a secure method for obtaining a person's or an organization's public key, with sufficient assurance that the key is correct. There are three