authentication, digital certificates, and cryptography operations

Which method of authentication involves authenticating only part of the conversation between the sender and the receiver?

With intermediate authentication, only part of the conversation between users is authenticated.

Which system is used to generate digital certificates that could be trusted by both parties?

PKI is used to generate digital certificates that both parties in a communication could trust.

certification revocation list (CRL)

list of digital certificates that have been revoked by the issuing certificate authority

certificate signing request (CSR)

a block of encoded data given to a certficiate authority when applying for an SSL certificate; it is usually generated on the server where the certificate will be installed and contains information that will be included in the certifcate and the public key

digital signature US standard

SHA 512 provides integrity while RSA provides proof of origin

key points (digital signatures)

• they enable trusted electronic communications

• they are created by encrypting a hash (digest) of a message with the private key of the sender

• the sender may use a different public/private key pair digital signatures than they use for other encryption

public key infrastructure (PKI)

implementation of asymmetric (public key) cryptography

• software and hardware

• certificate authority

• practices and policy

• uses the x.509 digital certificate format

• public keys are published in certificates issued by the certificate authority

PKI elements

• registration for certificates

• certificate issuance

• storage of certificates

• distribution of certificates

• validation of certificates

certificate authorities

creates digital certificates

• classes of certificates (class 3 is very trusted like for banks)

• certificate binds user’s identity to the user’s public key

a digital certificate contains:

• version of certificate

• serial number

• algorithm used to sign certificate

• name of the certificate issuer

• validity dates

• name of owner

• public key of owner

• hash of certificate digitally signed with the private key of the certificate authority

registration authorities

• accepts registration requests from users

• validates users’ identities

• passes request to CA

cross certifications

users usually communicate directly with the certificate authority that issues their key pair

the certificate authority communicates with other trusted certificate authorities to

• verify certificates issued by another CA

• certificate authorities form a formal trust relationships between each other

web of trust

pretty good privacy (PGP) and Comodo etc. use an informal web of trust to replace formal certificate authority relationships

• users authenticate one another

key generation

random number generator (RNG)-vernam cipher

• pseudo random number generator (PRNG)- stream based encryption

key generation principles

• select from entire key space

• avoid patterns

• secure process

key storage

• hardware security module (HSM)

• smartcard

• token

• tamperproof container

key recovery

escrow

split knowledge (dual control)

offsite backups

key destruction

secure deletion of keys

crypto erasure