3.5.2 Public Key Infrastructure

Certificate Authorities

  • Digital Certificates

    • Definition: A digital certificate is a public assertion of identity that is validated by a certificate authority (CA).

    • Purpose: Used to authenticate the identity of an individual or system communicating online.

Certificate Attributes

  • Public Key Encryption

    • When transferring confidential messages, you provide your public key to the sender, allowing them to encrypt the message.

    • Decryption: Only your private key can decrypt the message, ensuring confidentiality.

  • Authentication

    • To authenticate yourself, you sign a hash of your message using your private key.

    • This signature can be verified by others using your public key, which assures them that you are the only one who could have created the signature.

Public Key Infrastructure (PKI)

  • Definition:

    • PKI is a framework that establishes trust in public key cryptography, enabling secure communications and message signatures using digital certificates.

  • Problems PKI Solves:

    • Ensures identity verification for public key owners, especially critical in e-commerce.

    • Addresses concerns about potential threats from malicious actors intercepting communications or modifying data.

  • Certificate Authority (CA):

    • Role: Issues digital certificates to confirm a public key's owner's identity.

    • Types of CAs:

    • Private CA: Established within an organization for internal use only, with limited trust.

    • Third-party CA: Used for public and business-to-business communications to instill a wider trust relationship (e.g., Comodo, DigiCert, GeoTrust, IdenTrust, Let's Encrypt).

Lifecycle of SSL/TLS Certificate Validation and Exchange

  • Communication Flow:

    1. Root Certificate Generation:

    • CA generates a root certificate signed by its private key and publishes this certificate with its public key.

    1. Root Certificate Storage:

    • The client retrieves and stores the CA’s root certificate in its trusted root certificate store.

    1. Certificate Signing Request (CSR):

    • The web server creates a CSR, which includes its public key and sends it to the CA for a signed certificate.

    1. Signed Certificate Issuance:

    • CA signs the CSR and returns the signed certificate to the web server.

    1. Certificate Validation by Client:

    • The client checks the web server's certificate to confirm it’s signed by a trusted CA.

    1. Secure Connection Establishment:

    • Upon validation, a secure and encrypted connection between client and server is established.

Functions of Third-Party Public CAs

  • Provide a range of useful certificate services for users including:

    • Ensuring the validity of certificates and the identities of certificate applicants (registration).

    • Establishing trust relationships with various stakeholders (users, governments, regulatory entities, enterprises).

    • Managing servers (repositories) for storing and administering certificates.

    • Executing key and certificate lifecycle management, especially focusing on revoking invalid certificates.

Digital Certificate Structure

  • A digital certificate serves as a wrapper for a subject's public key and includes:

    • Information about the subject and the issuer.

    • A digital signature from the issuing CA to prove authenticity.

  • Subject Types:

    • Can be human users (for message signing) or computer servers (for hosting secure transactions).

Certificate Viewer Details (Example Screenshot)

  • Certificate Hierarchy:

    • Displays the certificate chain (e.g., "DigiCert Global Root CA" to the end-entity certificate like "www.example.org").

  • Certificate Attributes:

    • Version: X.509 version of the certificate.

    • Serial Number: Unique identifier for the certificate.

    • Signature Algorithm: Algorithm used for signing (e.g., SHA-2, RSA).

    • Issuer: Name of the CA that issues the certificate.

    • Validity Period: Fields showing when the certificate is valid (Valid From and Valid To).

    • Subject: Organization's name and location.

    • Subject Public Key: Information about the public key algorithm and the key itself.

Certificate Revocation and Status Protocols

  • Reasons for Certificate Invalidity:

    • The issuing organization has ceased operations.

    • The private key has been compromised.

    • The certificate was identified as fake.

  • Certificate Revocation List (CRL):

    • A blacklist of invalidated certificates that must be constantly updated by CAs.

    • Browsers automatically download updated CRLs at set intervals.

  • Online Certificate Status Protocol (OCSP):

    • An internet protocol defined in the X.509 standard to verify certificate validity.

    • OCSP servers (responders) manage lists of revoked certificates.

    • Provides benefits such as timely status checking without downloading entire CRLs and more bandwidth-efficient communication.