PKI and OpenSSL part 1 X.509 from the user s and the client software s point of view
|
|
|
- Clement Valentine Rich
- 7 years ago
- Views:
Transcription
1 PKI and OpenSSL part 1 X.509 from the user s and the client software s point of view Version 0.5 Richard Levitte, mailto:levittelp.se November 18, 2003
2 A serie of lectures PKI and OpenSSL part 1: codex.509 from the user s and the client software s point of view. PKI and OpenSSL part 2: X.509 from the CA s point of view. PKI and OpenSSL part 3: to set up a CA using OpenSSL and CSP.
3 References Russ Housley, Tim Polk, Planning for PKI: Best Practics Guide for Deploying Public Key Infrastructure, ISBN , 2001 R. Housley, W. Polk, W. Ford, D. Solo, Internet X.509 Public Key Infrastructure Certificate and CRL Profile, RFC 3280, 2002
4 Public Key Cryptography: a reminder PKC is performed with pairs of keys: one private, one public. Anything encrypted with one of the keys in the pair can be decrypted by the other key in the pair. The private key is only known by the owner. The public key is known by everyone. Signing is performed by encrypting with the private key. Verification is performed by decrypting with the public key. This is used to prove authenticity of the signed document. Encryption is performed by encrypting with the public key. Decryption is performed by decrypting with the private key. This is used to make sure only the intended recidpient can read the encrypted document.
5 PKI basics: what s the big deal? Q: Who owns the private key? Q: How is that proven? A: Tie the identity securely with the key! Q: How do I know this is still true? Q: How do I know it s safe to use? A: Require expiration and out-of-band checks.
6 PKI basics: real world certificates Business card with PGP key fingerprint or a complete public key. This loosely ties the name on the business card with a public key. Problems: The card must be received in person, or there can be no trust. And still, everything on it may be a lie! The card can t realistically be taken back if the validity of the information changes. There s also no realistic way to check if the information is still valid.
7 PKI basics: real world certificates Credit card. Doesn t have a public key, so it isn t really a certificate in a PKI sense. Instead, it ties a name with an account number. Pros compared to business card: Has a visible issuer. With hologram techniques and recognisable images, it s hard to forge, and is therefore considered secure. Has name, account number and expiration date printed in raised letters, which is hard to changed after the card has been issued. Thanks to magnetic stripe, it can be used electronically. It has an expiration date, so validity is limited.
8 PKI basics: the ideal certificates 1. Purely digital object. 2. Contains name of private key holder, includes contact info 3. Easy to determine if issued recently 4. Created by trusted party rather than key holder 5. Easy to tell certificates from same issuer apart 6. Easy to determine if the certificate is genuine or forged 7. Tamper-proof 8. We can immediately determine if the information is no longer current 9. Easy to determine from certificate which application it applies to
9 PKI basics: general public key certificates Serial Number: 48 Certificate for: Company: Issued by: address: Bob Burton Fox Consulting CertsRUs, Inc. Activation: Jan 10, 2002 Expiration: Jan 10, 2004 Public Key: CertsRUs Digital Signature: 2421ab81fe61448a c6b fde8c ba7527c96148cbe1 4682ade412ed bd86124d90e16a d81e bde 89c562d5ae de8ade19ed9143
10 PKI basics: CA vs. EE CA = Certificate Authority. They issue certificates. EE = End Entity. The use certificates for services, authentication, identity. The two should not be mixed. A CA certificate must not be used to certify a server or a person. An EE certificate must not be used to sign other certificates.
11 PKI basics: PKI architectures Simple architectures Single CA : one trust point. Real easy, not very interoperable. Basic trust list : multiple trust points which are single CA s. Enterprise architectures Hierarchical PKI : a tree of CA s. The top of the tree is the normal trust point for everyone. Mesh PKI : every department has it s own individual CA, and all of them cross-certify with each other. The trust point is usually your own CA.
12 PKI basics: more PKI architectures Hybrid PKI architectures Extended trust list : like the trust list, but each entry may point at any kind of architecture. This is the most common way in web browsers. Cross-certified Enterprise PKIs : many enterprises cross-certify with their partners, and form a mesh PKI at a higher level. Bridge CA Architecture : when many enterprises cross-certify, the number of certificates to keep track of gets quite large. A bridge CA is an intermediate CA that cross-certifies with every enterprise. The bridge is never used as a trust point.
13 X.500: The directory In the beginning, there was the directory (X.500). It was designed to become a gigantic global on-line phone directory. The directory needed security. Public Key cryptography was chosen, and the certificate was created (X.509, 1988). The directory never became a reality except in some enterprises and communities. They never got connected together. The certificate was still cool, and got used as a general authentication tool for some protocols. The most popular are still SSL and TLS. PKIX (a working group of IETF) started working on standardising the use of X.509 certificates on the Internet. Today, the result is RFC 3280 and a bunch more.
14 X.509: certificates version v1 serialnumber 48 signature issuer validity subject subjectpublickeyinfo signaturealgorithm signature DSA with SHA-1 C=US; L=CA; O=CertsRUs, Inc.; CN=CA Z to Z C=US; O=Fox Consulting, Inc.; OU=R&D; CN=Bob Burton RSA, 2421ab81fe61448a c6b fde8c ba7527c96148cbe1 4682ade412ed8923 DSA with SHA-1 83bd86124d90e16a d81e bde 89c562d5ae de8ade19ed9143
15 X.509: certificates version v2 serialnumber 48 signature issuer validity subject subjectpublickeyinfo issueruniqueid subjectuniqueid signaturealgorithm signature DSA with SHA-1 C=US; L=CA; O=CertsRUs, Inc.; CN=CA Z to Z C=US; O=Fox Consulting, Inc.; OU=R&D; CN=Bob Burton RSA, 2421ab81fe61448a c6b fde8c ba7527c96148cbe1 4682ade412ed8923 (usually omitted) (usually omitted) DSA with SHA-1 83bd86124d90e16a d81e bde 89c562d5ae de8ade19ed9143
16 X.509: certificates version v3 serialnumber 48 signature issuer validity subject subjectpublickeyinfo issueruniqueid subjectuniqueid extensions signaturealgorithm signature DSA with SHA-1 C=US; L=CA; O=CertsRUs, Inc.; CN=CA Z to Z C=US; O=Fox Consulting, Inc.; OU=R&D; CN=Bob Burton RSA, 2421ab81fe61448a c6b fde8c ba7527c96148cbe1 4682ade412ed8923 (usually omitted) (usually omitted) DSA with SHA-1 83bd86124d90e16a d81e bde 89c562d5ae de8ade19ed9143
17 PKI basics: X.509 certification Serial Number: 112 Serial Number: 48 Serial Number: 206 Issuer: Fox Subject: Hawk Data Issuer: Hawk Data Subject: Dove Ltd Issuer: Dove Ltd Subject: Doug Dillon Hawk s Public Key Fox CA s Signature Dove s Public Key Hawk CA s Signature Doug s Public Key Dove CA s Signature
18 PKI basics: older X.509 certificate formats, the horrors! Misuse of certificates (for applications it wasn t meant for) Anyone can sign any certificate! Everyone must rely on the same certification policy So, what address does this person have? Is alice@fox.com the same as C=US; O=Fox Consulting, Inc; CN=Alice Adams? Is the same as C=US; O=Fox Consulting, Inc; CN=Web Server? The latter was solved with subject names like C=US; O=Fox Consulting, Inc; CN=Alice Adams; address=alice@fox.com and C=US; O=Fox Consulting, Inc; CN= which is ugly and counterproductive
19 PKI basics: X.509 v3 certificates extensions Subject type : is the certificate a CA or EE certificate? Identity information : DNS names, addresses Key attributes : can this key be used for key transport? Can it also be used to verify a digital signature? Policy information : can I trust Alice s certificate? Is it appropriate for large value transactions? Additional information where can I find the CA certificate for the issuer of this certificate? Where can I find the certificate revocation list for that issuer?
20 PKI basics: X.509 v3 certificates extensions Extensions can be critical. If it is, it must be recognised, or the certificate is invalid. If it isn t critical, it can safely be ignored. Subject type extensions Basic Constraints : CA, a boolean that is true if this is a CA certificate. pathlenconstraint, an integer that contains the number of steps further one may walk along the certificate chain.
21 PKI basics: X.509 v3 certificates extensions Name Extensions Subject Alternative Name : may contain extra identifiers, like DNS names (for servers, for example), IP addresses (useful in IPsec), addresses (for persons), and other types of data (Microsoft uses this to contain Kerberos data). Name Constraints : used in CA certificates to constrain what names may be verified with it. This applies both to the basic subject name and the names gven in the subject alternate name. It s composed of a serie of permitted and excluded subtrees.
22 PKI basics: X.509 v3 certificates extensions Key Attributes Key Usage : identifies the security services that the public key can be used for. They include: keycertsign : the public key may be used to verify signatures on certificates. crlsign : the public key may be used to verify signatures on CRLs non-repudiation : the public key may be used to verify signature on documents and protects against the signer falsely denying some action. digitalsignature : the public key may be used to verify signatures in other cases than the three given above. keyencipherment : the public key may be used for key transport and key management. dataencipherment : the public key may be used to encrypt data other than cryptographic keys.
23 PKI basics: X.509 v3 certificates extensions Key Attributes Key Usage : identifies the security services that the public key can be used for. They include: keyagreement : the public key may be used for key agreement. This is used when a DH key must be used for key management. encipheronly : the symmetric key resulting from key agreement may only be used for encrypting data. decipheronly : the symmetric key resulting from key agreement may only be used for decrypting data.
24 PKI basics: X.509 v3 certificates extensions Key Attributes Subject Key Identifier : a hash value of the private key connected to this certificate. That makes it easier to keep track of which private key corresponds to which certificate. Authority Key Identifier : a hash value of the private key connected to the issuer s certificate, or the issuer name and serial number from the issuer s certificate. That makes it easier to find the issuer s certificate when it has more than one, and thereby helps in certification path construction. Serial Number: 112 Issuer: Fox Subject: Hawk Data AKI: Fox; 0 Serial Number: 48 Issuer: Hawk Data Subject: Dove Ltd AKI: Fox; 112 Serial Number: 206 Issuer: Dove Ltd Subject: Doug Dillon AKI: Hawk Data; 48 Fox CA s Signature Hawk CA s Signature Dove CA s Signature
25 PKI basics: X.509 v3 certificates extensions Policy Information Certificate policies : a number of identities for the policy or policies that this certificate has been issued under. Policy Mapping : when several CA s cross-certify, they usually don t have the same policy identifiers. However, they may agree that some of their policies are similar enough to be considered equal. The issued cross-certificates will then contain the mapping between those policies. Policy Constraints : can be used to require that each certificate in the path has a valid policy identity, and can be used to prohibit policy mapping. For both these cases, there is a counter that says in how many steps this restriction starts to apply.
26 PKI basics: X.509 v3 certificates extensions Additional Information CRL Distribution point : in a CA cerificate, says where to find the CRL generated by that issuer. Authority Information Access : points at other validation resources, for example an OCSP responder.
27 PKI basics: X.509 v3 certificates extensions As you can imagine, there are many more extension, some standardised, some not. There are also many ways to abuse them (for example, setting the critical flag on non-standard), and most likely, we have not seen the end of creativity in this department.
28 PKI basics: X.509 v2 Certificate Revocation List version signature issuer thisupdate nextupdate revokedcertificates v2 DSA with SHA-1 C=US; L=CA; O=CertsRUs, Inc.; CN=CA Z Z (see next page]) crlextensions signaturealgorithm signature DSA with SHA-1 83bd86124d90e16a d81e bde 89c562d5ae de8ade19ed9143 usercertificate 48 revocationdate Z crlentryextensions
29 PKI basics: X.509 Certificate Path Construction The best source here is draft-ietf-pkix-certpathbuild-01.txt, until it becomes and RFC...
30 PKI basics: X.509 Certificate Path Validation The best source here is RFC 3280.
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate
X.509 Certificate Generator User Manual
X.509 Certificate Generator User Manual Introduction X.509 Certificate Generator is a tool that allows you to generate digital certificates in PFX format, on Microsoft Certificate Store or directly on
Certification Authority. The X.509 standard, PKI and electronic documents. X.509 certificates. X.509 version 3. Critical extensions.
The X.509 standard, PKI and electronic uments Antonio Lioy < lioy @ polito.it > Politecnico di Torino Dipartimento di Automatica e Informatica Certification Authority (4) cert repository (cert, CRL) Certification
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Ciphermail S/MIME Setup Guide
CIPHERMAIL EMAIL ENCRYPTION Ciphermail S/MIME Setup Guide September 23, 2014, Rev: 6882 Copyright 2008-2014, ciphermail.com. CONTENTS CONTENTS Contents 1 Introduction 3 2 S/MIME 3 2.1 PKI...................................
DEPARTMENT OF DEFENSE PUBLIC KEY INFRASTRUCTURE EXTERNAL CERTIFICATION AUTHORITY MASTER TEST PLAN VERSION 1.0
DEFENSE INFORMATION SYSTEMS AGENCY JOINT INTEROPERABILITY TEST COMMAND FORT HUACHUCA, ARIZONA DEPARTMENT OF DEFENSE PUBLIC KEY INFRASTRUCTURE EXTERNAL CERTIFICATION AUTHORITY MASTER TEST PLAN VERSION 1.0
Purpose of PKI PUBLIC KEY INFRASTRUCTURE (PKI) Terminology in PKIs. Chain of Certificates
Purpose of PKI PUBLIC KEY INFRASTRUCTURE (PKI) Purpose, Methods, Revocation, PKIX To distribute public keys securely Requires - Certificates and Certification Authorities - Method for retrieving certificates
Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 15.1
Chapter 15 Key Management Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 15.1 Symmetric-key Distribution Symmetric-key cryptography is more efficient than asymmetric-key
associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.
Foundations for secure e-commerce (bmevihim219) Dr. Levente Buttyán associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) buttyan@hit.bme.hu, buttyan@crysys.hu
Brocade Engineering. PKI Tutorial. Jim Kleinsteiber. February 6, 2002. Page 1
PKI Tutorial Jim Kleinsteiber February 6, 2002 Page 1 Outline Public Key Cryptography Refresher Course Public / Private Key Pair Public-Key Is it really yours? Digital Certificate Certificate Authority
public key version 0.2
version 0.2 Typeset in L A TEX from SGML source using the DocBuilder-0.9.8.4 Document System. Contents 1 User s Guide 1 1.1 Introduction.......................................... 1 1.1.1 Purpose........................................
Key Management. CSC 490 Special Topics Computer and Network Security. Dr. Xiao Qin. Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.
CSC 490 Special Topics Computer and Network Security Key Management Dr. Xiao Qin Auburn University http://www.eng.auburn.edu/~xqin xqin@auburn.edu Slide 09-1 Overview Key exchange Session vs. interchange
Part III-a. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT
Part III-a Contents Part III-a Public-Key Infrastructure (PKI) Definition of a PKI and PKI components PKI Trust Models Digital Certificate, X.509 Certificate Management and Life Cycle Public Key Infrastructure
Cryptography and Network Security Chapter 14. Key Distribution. Key Management and Distribution. Key Distribution Task 4/19/2010
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
Certificates. Noah Zani, Tim Strasser, Andrés Baumeler
Certificates Noah Zani, Tim Strasser, Andrés Baumeler Overview Motivation Introduction Public Key Infrastructure (PKI) Economic Aspects Motivation Need for secure, trusted communication Growing certificate
OFFICE OF THE CONTROLLER OF CERTIFICATION AUTHORITIES TECHNICAL REQUIREMENTS FOR AUDIT OF CERTIFICATION AUTHORITIES
OFFICE OF THE CONTROLLER OF CERTIFICATION AUTHORITIES TECHNICAL REQUIREMENTS FOR AUDIT OF CERTIFICATION AUTHORITIES Table of contents 1.0 SOFTWARE 1 2.0 HARDWARE 2 3.0 TECHNICAL COMPONENTS 2 3.1 KEY MANAGEMENT
Cryptography and Network Security Chapter 14
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
Entrust Managed Services PKI. Getting started with digital certificates and Entrust Managed Services PKI. Document issue: 1.0
Entrust Managed Services PKI Getting started with digital certificates and Entrust Managed Services PKI Document issue: 1.0 Date of issue: May 2009 Copyright 2009 Entrust. All rights reserved. Entrust
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
DIMACS Security & Cryptography Crash Course, Day 2 Public Key Infrastructure (PKI)
DIMACS Security & Cryptography Crash Course, Day 2 Public Key Infrastructure (PKI) Prof. Amir Herzberg Computer Science Department, Bar Ilan University http://amir.herzberg.name Amir Herzberg, 2003. Permission
Information Systems Security Management
Information Systems Security Management Gerald Quirchmayr, Edgar Weippl, Oliver Jorns Fakultät für Wirtschaftswissenschaften und Informatik Liebiggasse 4/3-4, 1010 Wien Tel. +43-1-4277-38431 Fax +43-1-4277-38449
Asymmetric cryptosystems fundamental problem: authentication of public keys
Network security Part 2: protocols and systems (a) Authentication of public keys Università degli Studi di Brescia Dipartimento di Ingegneria dell Informazione 2014/2015 Asymmetric cryptosystems fundamental
An LDAP/X.500 based distributed PGP Keyserver
An LDAP/X.500 based distributed PGP Keyserver First PGP Keyserver Manager Symposium 22.-23. May 2000, Utrecht Peter Gietz Peter.gietz@directory.dfn.de Agenda PKI and Directory X.500 LDAP PGP Keyserver
How To Make A Trustless Certificate Authority Secure
Network Security: Public Key Infrastructure Guevara Noubir Northeastern University noubir@ccs.neu.edu Network Security Slides adapted from Radia Perlman s slides Key Distribution - Secret Keys What if
Key Management and Distribution
Key Management and Distribution Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu udio/video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
CS 356 Lecture 28 Internet Authentication. Spring 2013
CS 356 Lecture 28 Internet Authentication Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists
Dr. Cunsheng DING HKUST, Hong Kong. Security Protocols. Security Protocols. Cunsheng Ding, HKUST COMP685C
Cunsheng Ding, HKUST Lecture 06: Public-Key Infrastructure Main Topics of this Lecture 1. Digital certificate 2. Certificate authority (CA) 3. Public key infrastructure (PKI) Page 1 Part I: Digital Certificates
Certificates and network security
Certificates and network security Tuomas Aura CSE-C3400 Information security Aalto University, autumn 2014 Outline X.509 certificates and PKI Network security basics: threats and goals Secure socket layer
Understanding Digital Certificates and Secure Sockets Layer (SSL)
Understanding Digital Certificates and Secure Sockets Layer (SSL) Author: Peter Robinson January 2001 Version 1.1 Copyright 2001-2003 Entrust. All rights reserved. Digital Certificates What are they?
What is a digital certificate, why do I need one, and how do I get it?
PKI FAQ s What is a digital signature and how do you get one? You can t buy a digital signature. It s not like a handwritten one. A digital signature is different every time it is made, and is related
1 Public Key Cryptography and Information Security
International Carpathian Control Conference ICCC 2002 MALENOVICE, CZECH REPUBLIC May 27-30, 2002 IMPLEMENTATION ISSUES OF PKI TECHNOLOGY Victor-Valeriu PATRICIU, Marin BICA and Ion BICA Department of Computer
Network Security: Public Key Infrastructure
Network Security: Public Key Infrastructure Guevara Noubir Northeastern University noubir@ccs.neu.edu CSG254: Network Security Slides adapted from Radia Perlman s slides Key Distribution - Secret Keys
AD CS. http://technet.microsoft.com/en-us/library/cc731564.aspx
AD CS AD CS http://technet.microsoft.com/en-us/library/cc731564.aspx Active Directory Certificate Services (AD CS) is an Identity and Access Control security technology that provides customizable services
Authentication Applications
Authentication Applications CSCI 454/554 Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures Kerberos a symmetric-key
A PKI For IDR Public Key Infrastructure and Number Resource Certification
A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC If You wanted to be Bad on the Internet And you wanted to: Hijack a site Inspect
APNIC Trial of Certification of IP Addresses and ASes
APNIC Trial of Certification of IP Addresses and ASes RIPE 51 11 October 2005 Geoff Huston 1 Address and Routing Security What we have today is a relatively insecure system that is vulnerable to various
Validity Models of Electronic Signatures and their Enforcement in Practice
Validity Models of Electronic Signatures and their Enforcement in Practice Harald Baier 1 and Vangelis Karatsiolis 2 1 Darmstadt University of Applied Sciences and Center for Advanced Security Research
DATEVe:secure MAIL V1.1. ISIS-MTT-Assessment Report
DATEVe:secure MAIL V1.1 DATEV eg ISIS-MTT-Assessment Report Version 1.1 Date 08. July 2004 Hans-Joachim Knobloch, Fritz Bauspiess Secorvo Security Consulting GmbH Albert-Nestler-Straße 9 D-76131 Karlsruhe
Evaluation of Certificate Revocation in Microsoft Information Rights Management v1.0
Evaluation of Certificate Revocation in Microsoft Information Rights Management v1.0 Hong Zhou hzho021@ec.auckland.ac.nz for CompSci725SC, University of Auckland. 20 October 2006 Abstract Certificate revocation
Network Security. Gaurav Naik Gus Anderson. College of Engineering. Drexel University, Philadelphia, PA. Drexel University. College of Engineering
Network Security Gaurav Naik Gus Anderson, Philadelphia, PA Lectures on Network Security Feb 12 (Today!): Public Key Crypto, Hash Functions, Digital Signatures, and the Public Key Infrastructure Feb 14:
CSE543 - Introduction to Computer and Network Security. Module: Public Key Infrastructure
CSE543 - Introduction to Computer and Network Security Module: Public Key Infrastructure Professor Trent Jaeger 1 Meeting Someone New Anywhere in the Internet 2 What is a certificate? A certificate makes
Public Key Infrastructure. A Brief Overview by Tim Sigmon
Public Key Infrastructure A Brief Overview by Tim Sigmon May, 2000 Fundamental Security Requirements (all addressed by PKI) X Authentication - verify identity of communicating parties X Access Control
Certificate Path Validation
Version 1.4 NATIONAL SECURITY AUTHORITY Version 1.4 Certificate Path Validation 19 th November 2006 No.: 1891/2006/IBEP-011 NSA Page 1/27 NATIONAL SECURITY AUTHORITY Department of Information Security
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution.
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution. 1 Opening quote. 2 The topics of cryptographic key management
Understanding digital certificates
Understanding digital certificates Mick O Brien and George R S Weir Department of Computer and Information Sciences, University of Strathclyde Glasgow G1 1XH mickobrien137@hotmail.co.uk, george.weir@cis.strath.ac.uk
Network Security Protocols
Network Security Protocols EE657 Parallel Processing Fall 2000 Peachawat Peachavanish Level of Implementation Internet Layer Security Ex. IP Security Protocol (IPSEC) Host-to-Host Basis, No Packets Discrimination
A Survey of State of the Art in Public Key Infrastructure
A Survey of State of the Art in Public Key Infrastructure NR Rapport nr. 995 Shahrzade Mazaher Per Røe August 2003 Copyright Norsk Regnesentral 1 Tittel/Title: A survey of state of the art in Public Key
[SMO-SFO-ICO-PE-046-GU-
Presentation This module contains all the SSL definitions. See also the SSL Security Guidance Introduction The package SSL is a static library which implements an API to use the dynamic SSL library. It
SBClient SSL. Ehab AbuShmais
SBClient SSL Ehab AbuShmais Agenda SSL Background U2 SSL Support SBClient SSL 2 What Is SSL SSL (Secure Sockets Layer) Provides a secured channel between two communication endpoints Addresses all three
WIRELESS LAN SECURITY FUNDAMENTALS
WIRELESS LAN SECURITY FUNDAMENTALS Jone Ostebo November 2015 #ATM15ANZ @ArubaANZ Learning Goals Authentication with 802.1X But first: We need to understand some PKI And before that, we need a cryptography
Introduction to Network Security Key Management and Distribution
Introduction to Network Security Key Management and Distribution Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology cetinkayae@mst.edu http://web.mst.edu/~cetinkayae/teaching/cpe5420fall2015
CALIFORNIA SOFTWARE LABS
; Digital Signatures and PKCS#11 Smart Cards Concepts, Issues and some Programming Details CALIFORNIA SOFTWARE LABS R E A L I Z E Y O U R I D E A S California Software Labs 6800 Koll Center Parkway, Suite
Interoperability Guidelines for Digital Signature Certificates issued under Information Technology Act
for Digital Signature Certificates issued under Information Technology Act Version 2.4 December 2009 Controller of Certifying Authorities Department of Information Technology Ministry of Communications
Certificate Management. PAN-OS Administrator s Guide. Version 7.0
Certificate Management PAN-OS Administrator s Guide Version 7.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
Grid Computing - X.509
Grid Computing - X.509 Sylva Girtelschmid October 20, 2009 Public Key Infrastructure - PKI PKI Digital Certificates IT infrastructure that provides means for private and secure data exchange By using cryptographic
A PKI approach targeting the provision of a minimum security level within Internet
A PKI approach targeting the provision of a minimum security level within Internet Maryline Laurent-Maknavicius CNRS Samovar UMR 5157, GET/INT/LOR Maryline.Maknavicius@int-evry.fr Abstract After decades
Public Key Infrastructure
UT DALLAS Erik Jonsson School of Engineering & Computer Science Public Key Infrastructure Murat Kantarcioglu What is PKI How to ensure the authenticity of public keys How can Alice be sure that Bob s purported
Authentication Applications
Authentication Applications will consider authentication functions developed to support application-level authentication & digital signatures will consider Kerberos a private-key authentication service
Lecture VII : Public Key Infrastructure (PKI)
Lecture VII : Public Key Infrastructure (PKI) Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Computer Science Department, National Chiao Tung University 2 Problems with Public
Authentication Application
Authentication Application KERBEROS In an open distributed environment servers to be able to restrict access to authorized users to be able to authenticate requests for service a workstation cannot be
UNDERSTANDING PKI: CONCEPTS, STANDARDS, AND DEPLOYMENT CONSIDERATIONS, 2ND EDITION
UNDERSTANDING PKI: CONCEPTS, STANDARDS, AND DEPLOYMENT CONSIDERATIONS, 2ND EDITION Foreword. Preface. About the Authors. I. CONCEPTS. 1. Introduction. 2. Public-Key Cryptography. Symmetric versus Asymmetric
Introduction to Public Key Technology and the Federal PKI Infrastructure 26 February 2001
Introduction to Public Key Technology and the Federal PKI Infrastructure 26 February 2001 D. Richard Kuhn Vincent C. Hu W. Timothy Polk Shu-Jen Chang National Institute of Standards and Technology, 2001.
Public-Key Infrastructure
Public-Key Infrastructure Technology and Concepts Abstract This paper is intended to help explain general PKI technology and concepts. For the sake of orientation, it also touches on policies and standards
Expert Reference Series of White Papers. Fundamentals of the PKI Infrastructure
Expert Reference Series of White Papers Fundamentals of the PKI Infrastructure 1-800-COURSES www.globalknowledge.com Fundamentals of the PKI Infrastructure Boris Gigovic, Global Knowledge Instructor, CEI,
PUBLIC-KEY CERTIFICATES
INFS 766 Internet Security Protocols Lecture 6 Digital Certificates Prof. Ravi Sandhu PUBLIC-KEY CERTIFICATES reliable distribution of public-keys public-key encryption sender needs public key of receiver
Meeting the FDA s Requirements for Electronic Records and Electronic Signatures (21 CFR Part 11)
Meeting the FDA s Requirements for Electronic Records and Electronic Signatures (21 CFR Part 11) Executive Summary...3 Background...4 Internet Growth in the Pharmaceutical Industries...4 The Need for Security...4
X.509 Certificate Revisited
X.509 Certificate Revisited Tohari Ahmad Informatics Department, Faculty of Information Technology - FTIF, ITS Surabaya Email: tohari@its-sby.edu Abstract A digital certificate is used for identifying
Guidelines and instructions on security for electronic data interchange (EDI) English translation 2011-06-23 based on Swedish version 2.
Guidelines and instructions on security for electronic data interchange (EDI) English translation 2011-06-23 based on Swedish version 2.0 This is an unofficial translation. In case of any discrepancies
How To Encrypt Data With Encryption
USING ENCRYPTION TO PROTECT SENSITIVE INFORMATION Commonwealth Office of Technology Security Month Seminars Alternate Title? Boy, am I surprised. The Entrust guy who has mentioned PKI during every Security
Lecture 31 SSL. SSL: Secure Socket Layer. History SSL SSL. Security April 13, 2005
Lecture 31 Security April 13, 2005 Secure Sockets Layer (Netscape 1994) A Platform independent, application independent protocol to secure TCP based applications Currently the most popular internet crypto-protocol
Certificate Policy for. SSL Client & S/MIME Certificates
Certificate Policy for SSL Client & S/MIME Certificates OID: 1.3.159.1.11.1 Copyright Actalis S.p.A. All rights reserved. Via dell Aprica 18 20158 Milano Tel +39-02-68825.1 Fax +39-02-68825.223 www.actalis.it
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt 1 Lecture 11: Network Security Reference: Chapter 8 - Computer Networks, Andrew S. Tanenbaum, 4th Edition, Prentice
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
Driving Safely on Information Highway. April 2006
Driving Safely on Information Highway April 2006 Agenda FIPS 201 and PK enabling Challenges of PK enabling Ways to meet the challenges PKIF Webcullis (demo) TrustEnabler (demo) FIPS 201 unique PK enabling
Business Issues in the implementation of Digital signatures
Business Issues in the implementation of Digital signatures Much has been said about e-commerce, the growth of e-business and its advantages. The statistics are overwhelming and the advantages are so enormous
NIST Test Personal Identity Verification (PIV) Cards
NISTIR 7870 NIST Test Personal Identity Verification (PIV) Cards David A. Cooper http://dx.doi.org/10.6028/nist.ir.7870 NISTIR 7870 NIST Text Personal Identity Verification (PIV) Cards David A. Cooper
mod_ssl Cryptographic Techniques
mod_ssl Overview Reference The nice thing about standards is that there are so many to choose from. And if you really don t like all the standards you just have to wait another year until the one arises
Digital Certificates Demystified
Digital Certificates Demystified Alyson Comer IBM Corporation System SSL Development Endicott, NY Email: comera@us.ibm.com February 7 th, 2013 Session 12534 (C) 2012, 2013 IBM Corporation Trademarks The
CS 392/681 - Computer Security
CS 392/681 - Computer Security Module 3 Key Exchange Algorithms Nasir Memon Polytechnic University Course Issues HW 3 assigned. Any lab or course issues? Midterm in three weeks. 8/30/04 Module 3 - Key
Public Key Cryptography in Practice. c Eli Biham - May 3, 2005 372 Public Key Cryptography in Practice (13)
Public Key Cryptography in Practice c Eli Biham - May 3, 2005 372 Public Key Cryptography in Practice (13) How Cryptography is Used in Applications The main drawback of public key cryptography is the inherent
Chapter 7 Managing Users, Authentication, and Certificates
Chapter 7 Managing Users, Authentication, and Certificates This chapter contains the following sections: Adding Authentication Domains, Groups, and Users Managing Certificates Adding Authentication Domains,
SSL Protect your users, start with yourself
SSL Protect your users, start with yourself Kulsysmn 14 december 2006 Philip Brusten Overview Introduction Cryptographic algorithms Secure Socket Layer Certificate signing service
Ciphire Mail. Abstract
Ciphire Mail Technical Introduction Abstract Ciphire Mail is cryptographic software providing email encryption and digital signatures. The Ciphire Mail client resides on the user's computer between the
Reducing Certificate Revocation Cost using NPKI
Reducing Certificate Revocation Cost using NPKI Albert Levi and Çetin Kaya Koç Oregon State University, Electrical and Computer Engineering Dept., Information Security Lab, Corvallis, Oregon, USA levi@ece.orst.edu
Certificate Management in Ad Hoc Networks
Certificate Management in Ad Hoc Networks Matei Ciobanu Morogan, Sead Muftic Department of Computer Science, Royal Institute of Technology [matei, sead] @ dsv.su.se Abstract Various types of certificates
TeliaSonera Public Root CA. Certification Practice Statement. Revision Date: 2006-11-17. Version: Rev A. Published by: TeliaSonera Sverige AB
Document no 1/011 01-AZDA 102 213 TeliaSonera Sverige AB Certification Practice Statement Rev A TeliaSonera Public Root CA Certification Practice Statement Revision Date: 2006-11-17 Version: Rev A Published
Certification Path Processing in the Tumbleweed Validation Authority Product Line Federal Bridge CA Meeting 10/14/2004
Certification Path Processing in the Tumbleweed Validation Authority Product Line Federal Bridge CA Meeting 10/14/2004 Stefan Kotes, Engineering Manager Agenda Tumbleweed company overview Certification
7 Key Management and PKIs
CA4005: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Key Management and PKIs 7.1 Key Management Key Management For any use of cryptography, keys must be handled correctly. Symmetric keys must be kept secret.
A PKI case study: Implementing the Server-based Certificate Validation Protocol
54 ISBN: 978-960-474-048-2 A PKI case study: Implementing the Server-based Certificate Validation Protocol MARIUS MARIAN University of Craiova Department of Automation ROMANIA marius.marian@cs.ucv.ro EUGEN
Cross-Certification and PKI Policy Networking
Entrust Cross-Certification and PKI Policy Networking Author: Jim Turnbull Date: August 2000 Version: 1.0 Copyright 2000-2003 Entrust. All rights reserved. 1 Entrust is a registered trademark of Entrust,
ETSI TS 102 280 V1.1.1 (2004-03)
TS 102 280 V1.1.1 (2004-03) Technical Specification X.509 V.3 Certificate Profile for Certificates Issued to Natural Persons 2 TS 102 280 V1.1.1 (2004-03) Reference DTS/ESI-000018 Keywords electronic signature,
Digital Signatures in a PDF
This document describes how digital signatures are represented in a PDF document and what signature-related features the PDF language supports. Adobe Reader and Acrobat have implemented all of PDF s features
How To Understand And Understand The Security Of A Key Infrastructure
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography Objectives Define digital certificates List the various types of digital certificates and how they are used
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
OpenCA v1.0.2+ (ten-ten 2 )
Supported by Interoperability and Usability of PKI Dartmouth College http://www.openca.org OpenCA v1.0.2+ (ten-ten 2 ) Massimiliano Pala Outline Basic Installation Procedures
encryption keys, signing keys are not archived, reducing exposure to unauthorized access to the private key.
The way the world does business is changing, and corporate security must change accordingly. For instance, e-mail now carries not only memos and notes, but also contracts and sensitive financial information.
Restricting Access with Certificate Attributes in Multiple Root Environments A Recipe for Certificate Masquerading
Restricting Access with Certificate Attributes in Multiple Root Environments A Recipe for Certificate Masquerading Capt James M. Hayes, USAF Systems and Network Attack Center National Security Agency Suite
Concept of Electronic Approvals
E-Lock Technologies Contact info@elock.com Table of Contents 1 INTRODUCTION 3 2 WHAT ARE ELECTRONIC APPROVALS? 3 3 HOW DO INDIVIDUALS IDENTIFY THEMSELVES IN THE ELECTRONIC WORLD? 3 4 WHAT IS THE TECHNOLOGY
PKI: Public Key Infrastructure
PKI: Public Key Infrastructure What is it, and why should I care? Conference on Higher Education Computing in Kansas June 3, 2004 Wes Hubert Information Services The University of Kansas Why? PKI adoption
Securing Service Access with Digital Certificates Best Practice Document
Securing Service Access with Digital Certificates Best Practice Document Produced by AMRES Security Group (AMRES BPD 106) Author: Milica Kovinić Contributors: Dušan Pajin, Mara Bukvić, Marko Stojaković,