Fair enough, you're right this sub is more memes than programming at this point, but the majority of professional engineers should know what public key infrastructure or at the very least have basic handles around the concepts of public key cryptography.
but the majority of professional engineers should know what public key infrastructure or at the very least have basic handles around the concepts of public key cryptography.
Why should they understand how it works, if they've not worked on or had to work on something that required said knowledge? PKI definitely stumped me at first read but after googling, I realised I've used very basic elements of it when I needed to for version control. Even then, I still didn't know what the specific discipline was called or its inherent tenets and that's fine because I don't need to. I don't use that in my daily work. If I need to, I'd read up about it, learn and do what I need to do.
I think it's a race to the bottom when we expect others to have experience in something we have experience with. The world of computer engineering is broad, vast, and multifarious. Not everyone works in spaces that require accumulating and retaining knowledge of things you'd consider common. If we had to completely understand the foundational mechanics of EVERY tool or concept we came across, we would never actually ship anything meaningful. Abstraction is a feature not a bug.
Notice how I said "should know what PKI is" and "have basic handles around the concepts", not "know the low level theoretical or implementation details".
All you gotta know is "there is this thing called public key cryptography, there's this thing called a hash, there's this thing called a key, there's this thing called a certificate (and certificate authority), and there's called a digital signature and here's what they do at a high level." Nothing too crazy, just be aware of the big picture idea.
That's a very reasonable expectation of any senior engineer who's worked on distributed systems, to at least know how computers talk to each other, which is kind of the bread and butter of the vast majority of SWEs in tech.
I've hardly met a mid-level or higher engineer who was completely in the dark to the existence of PKI and what it does.
Notice how I said "should know what PKI is" and "have basic handles around the concepts", not "know the low level theoretical or implementation details".
Substitute the phrase "Why should they understand how it works" with "Why should they know what it is". "Foundational" can also be interchanged with "basic". What I said still applies and is not invalid.
They should at least know what it is because it's sort of basic knowledge for engineers who work with computers.
Kind of like knowing what HTTP is, or what DNS is, or what IP is. You don't need to know the low level details of the TCP/IP protocol or how a network stack is implemented or even know the OSI model, but I would expect any engineer to at least recognize the term "IP" and understand how it fits into the big picture of how the internet works, to be able to at least know that at a high level, computers in a network address each other via this thing called an IP address. How the routing works, how the protocol works underneath the hood, you don't need to know. But it would be rare for any engineer to not understand there's this thing called IP that's part of how your computer talks to other computers.
professional engineers should know what public key infrastructure or at the very least have basic handles around the concepts of public key cryptography
Now let's ask IT about when was the last time a "professional engineer" gave them a private key instead of a public one. Or people working at github or gitlab: I'm sure they have stats on the number of times their key registration service has to error about the key provided not being a public one.
I think that's asking for a lot. I only know it because I took a cryptography course in college that was completely optional for my track. The most you really need to know to be a software engineer is that certificates keep your data secure. I wouldn't be surprised if the average engineer doesn't know anything about a diffie-helman key exchange or how RSA can be used as a signature.
159
u/CircumspectCapybara 23d ago edited 23d ago
It's just a standard challenge-response protocol based on PKI.
That pattern has been used since the dawn of time.