Section 7: Cryptography Part 3

PKI

used to create, manage, distribute, use, store, and revoke digital certificates and manage public key encryption.

PKI’s purpose

Is to facilitate the secure electronic transfer of info for a range of network activities such as e-commerce, banking, and confidential email

Have to setup PKI in order to have TLS

True

PKI utilizes hybrid cryptography and provides creation and use of Digital Signatures

True

SSL was replaced by

TLS (same thing basically)

External validation creates

Trust

Certificate authorities are like the DMV for computers

True

SSL Handshake Steps

1. Client issues secure session request

2. Server sends X.509 certificate containing servers public key

3. Client authenticates certificate against a list of known certificate authorities

4. Client generates random symmetric key and encrypts it using server’s public key

5. Client and server now both know the symmetric key and encrypt end user data using symmetric key for duration of session.

Key Components of PKI

• Digital Certificates

• Certificate Authority

• Registration Authority

• Validation Authority

Digital Certificates

electronic documents that contains a public key that use a digital signature to bind a public key with an identity.

Certificate Authority

A trusted entity that issues and manages digital certificates

Registration Authority

often acts as the verifier for the CA before a digital certificate is issued to a requestor

Validation Authority

checks if the certificate is still valid

Certificate Signing Request (CSR)

is a request sent to a CA to apply for a digital identity certificate

Key-pair Generation

first step in generating a CSR is to create a key pair which consists of a public and private key. The private key is kept secret and used to decrypt info encrypted with the public key or to create digital signatures.

All certificates coming out today are the X.509 certificate

True

End Entity Certificates

• Domain Validation

• Extended Validation

• Wildcard Certificates

• Self Signed Certificates

• Third-Party Certificates

Domain Validation (DV)

certificate is issued if control of a domain is proven

Extended Validation (EV)

certificate is a higher level of assurance if the CA can verify that the applicant is a legitimate business

Wildcard Certificates

is a type of digital certificate used in TLS/SSL encryption, typically for securing websites

Digital certificates can be either self-signed or issued by a third-party

True

Self Signed Certificates

is created and signed by the entity it represents. These are not inherently trusted by others. Trust must be established out-of-band, meaning users must have a sperate secure way to verify the certificate’s authenticity

Third -Party Certificates

is issued and signed by a trusted CA. The CA verifies the identity of the entity requesting the certificate, ensuring that the entity is who it claims to be (most trustworthy)

Root of Trust

refers to the trust anchor in a Public Key Infrastructure system. This is usually a root certificate authority that is inherently trusted, and from which the trustworthiness of all other certificates in the network is derived. (minimizes data breach or attack cause not getting to the root CA)

Certificate Pinning

a technique that helps to prevent MTIM attacks by hardening the SSL/TLS certificate’s public key into the app or device

Verification Process

1. Verify the digital signature of the CA is authentic

2. You trust the CA

3. The certificate is not listed on a CRL/Certificate Revocation List) or the Certificate Status Protocol.

4. The certificate actually contains the data you are trusting

Revocation

done when a certificate is compromised, issued by accident, cert details or the security association changes.

Certificate Revocation Lists

contain the serial numbers of certificates that have been revoked

Online Certificate Status Protocol (OSCP)

provides a means for real-time certificate verification

Certificate Stapling

avoids the client sending OSCP request, instead the webserver itself checks, validates the certificate with the CA.