Explain like I'm five · Security

What is PKI?

PKI and certificates, told as a story about an ID card stamped with the king's seal.

…really?I am the king's friend!me too, the king's friend!both say the same thingwords alone can't tell who is real

A stranger says he is the king's friend. Should we believe him?A thief can say exactly the same thing. Words alone can't tell who is real.

you can't ask the king every timethe king would see nothing but the linea line, all daya card he drew himselfand stamped it himselfID CARDking's friendvalid: forevermea card anyone can make proves nothing — who stamped it is what matters

We can't ask the king every time. And a card you draw yourself proves nothing.The king would see nothing but the line. Anyone can draw a card — what matters is who stamped it.

ID CARDMerchant Tomavalid: until Decemberthe king stamps it himselfcard = name + date + the king's sealthe king's seal samplea match — go on throughanyone can make a card — only the king can stamp itthe gatekeeper never calls the king — the seal is enough

PKI is the promise that we trust each other by cards the king has stamped.A card carries a name, a date, and the king's seal. With a sample of the seal, the gatekeeper knows without calling the king.

The king stamps itone person everyone trusts
The seal can't be copiedthe stamping seal stays in the vault
It has a dateexpired? get a new one
Lost? onto the listthe gatekeeper checks the list
the stamping sealonly the king has it — never lentthe checking sampleanyone may have oneyou can't stamp with a samplea copied stampthe shape doesn't matchone seal to stamp, many samples to check — that's why it can't be forged

One seal that stamps, many samples that check. That is why it can't be forged.Only the king holds the stamping seal, and never lends it. Anyone may hold a sample, but a sample can't stamp. A thief's copy never matches.

ID CARDMerchant Benvalid: until last MarchexpiredID CARDMerchant Tomavalid: until Decemberon the revoked listREVOKED LISTToma — card was lostID CARDMerchant Annavalid: until next Mayvalidnow the sealing promise beginsexpired or on the list, the gatekeeper turns it away

Expired or on the list, it's turned away. Once through, the sealing promise begins.Lose your card and the king writes your name on the revoked list. Once a card passes, the two of you can start exchanging sealed letters.

In one breath

PKI = trusting each other by ID cards stamped by a king everyone trusts. Only the king can stamp; anyone can check. Every card expires, and a lost one goes on the revoked list.

A Certificate Authority (CA) signs certificates with its private key; anyone verifies the signature with the CA's public key. Certificates expire, and revoked ones are checked via CRL or OCSP. TLS/HTTPS runs on top of this.

When grown-ups say it

Certificate
The card with the king's seal. A name, a date, a seal. The paper a shop (server) shows to say I am real.
Certificate Authority (CA)
The king who stamps. The one everyone agreed to trust. Issues the cards, and lists the lost ones.
Public / private key
The checking sample / the stamping seal. A sample can't stamp; what the seal stamped, the sample confirms. → the letter no one reads without the key
Validity · expiry
The date on the card. Past the date, even a real card is turned away. Shop cards today last under a year.
Revocation list (CRL / OCSP)
The revoked list. Names of lost or stolen cards. The gatekeeper checks it before letting anyone through.
Root certificate
The seal sample the gatekeeper keeps. Shipped inside your computer and browser. Without it, no card can be checked.
Self-signed
A card you drew yourself. Stamped by its own maker. Fine for practice inside the castle; the village won't trust it.
TLS
The sealing promise after the card. Only once the card passes do the sealed letters begin. → the sealing promise with the shop
Next story
The Sealing Promise with the Shop →
Want another term as a picture book? Request →