What security and assurance standards does Trustis use for TMDCS certificate services?

Transcription

1 Frequently Asked Questions What is a Digital Certificate? What is a Root Certificate? How do Digital Certificates Work? Who needs a Digital Certificate? How do I get a Digital Certificate Can I use my certificate issued by Trustis for other purposes? What security and assurance standards does Trustis use for TMDCS certificate services? Which web browsers are supported for use with administration portal? How do I collect my certificate? What about Cookies? Which Apple devices are compatible? Is there any way to backup my certificate? What is a Digital Certificate? In simple terms, a Digital Certificate (or Digital ID as it is sometimes known) is the electronic commerce world's analogue of the passport. It is a credential issued by a trusted authority that binds you as an individual to an identity that can be recognised and verified electronically by other entities. It confers certain rights and obligations on you according to policies exercised by the Issuing Authority. Because it uses cryptographic technology, it provides you with the ability to digitally sign s, documents or transactions, or to verify the signatures of others. It enables you to make s, documents or transactions only readable by those that you designate. In a real passport, various checks on you are made by a trusted representative of the Issuing Authority to ensure that you are who you say you are, and thus establish a binding between you as an individual and the paper document that declares your identity. In the digital certificate world, a trusted representative of the Issuing Authority must be satisfied that you are who you say you are, before a request is made to issue a digital certificate on your behalf. Just as a government officially vouches for your identity when it issues you with a passport, a Digital Certificate Issuing Authority vouches for your identity (or an element thereof) when it issues you with a digital certificate. For example, an Issuing Authority which issues you a digital certificate for secure is putting its name behind the claim that you are the holder of your address.

2 In a real passport, the methods used to ensure the integrity of the binding between you and the paper identity are such things as watermarks, seals, special paper and ink, etc. In the digital certificate world, the method used to ensure the integrity of the binding between an entity and its private key, is the digital signature of the Issuing Authority. What is a Root Certificate? A root certificate is the self-signed digital certificate of the Root Certificate Authority the Certificate Authority that provides the Trust Anchor in a Public Key Infrastructure. The public key in this root certificate is used to verify the digital signature of the Root Certificate Authority. The Root Certificate Authority's digital signature is present in all certificates that it issues (normally to Subordinate Issuing Authorities). Therefore, the root certificate can be used to verify the integrity of any certificate that the Root Certificate Authority signs. By downloading the root certificate, a user indicates trust in the Root Certificate Authority; consequently, this also indicates trust in the bindings that it creates between real identities and their corresponding digital certificates. How do Digital Certificates Work? One widely-used tool for privacy protection is what cryptographers call "symmetric" or "secret key" encryption, so named because a single, shared encryption key is used to both encrypt and to decrypt information. This key should obviously be kept secret from anyone not authorised to decrypt the information. Your logon password, your cash card PIN, and the information you provide to access your online bank accounts are all examples of secret keys. You share these secret keys only with the parties you want to communicate with, such as the bank or a credit card company. Your private information is then encrypted with this secret key, and it can only be decrypted by one of the parties holding that same key. Despite its widespread use, this secret-key system has some serious limitations. As network communications proliferate, it becomes very cumbersome for users to create and remember different passwords for each situation. Moreover, the sharing of a secret key involves inherent risks. When you give your mother's maiden name over the telephone, how do you know you can trust the party on the other end of the line? Can you be sure it is really the credit card company you are talking to? Can you be sure nobody is maliciously listening in? If you give somebody your mother's maiden name and that person abuses it for their own gain, how can you prove you did not authorise their use? Digital Certificate technology addresses these issues because it does not rely on the sharing of secret keys. Rather than using the same key to both encrypt and decrypt data, a Digital Certificate uses a matched pair of keys which complement one another. In other words, what is done by one key can only be undone by the other key in the pair. In this type of key-pair system, a user holds onto a "private key" and never gives it to anyone, while widely disseminating a "public key." Any information locked with the public key can only be unlocked by the corresponding private key, and vice versa. Since the public key alone does not provide access to communications, users do not need to worry about who may obtain this key.

3 For example, for the purposes of securing , key pairs can work in the following two ways: You can digitally sign your by enclosing an electronic stamp constructed by using your private key. When your recipient gets your message, their computer checks this stamp to see if it can be decrypted using your public key. If successful, the recipient knows that the message can only have come from the holder of the private key. Someone who wants to send you private can use your public key to encrypt the message. When you receive the , your computer determines if the public key used to encrypt the is a valid match for your private key. If the match is successful, the message gets decrypted and you can read it. Anyone who receives your but does not hold your private key will be unable to decrypt and read the message. The only problem is in knowing for sure that the public key you're about to use, actually belongs to the person to whom you think it does. This is where the Digital Certificate comes in. As discussed in "What is a Digital Certificate?" a Digital Certificate binds a public key to an individual or organisation. That binding of a public key to an individual or organisation is certified by a trusted Issuing Authority. A Digital Certificate makes it possible to verify someone's claim of rightful ownership of a given key, helping to prevent people from using counterfeit or stolen keys to impersonate other users. Used in conjunction with encryption, Digital Certificates provide a more complete security solution, assuring the identity of all parties involved in a transaction. Because a Digital Certificate uses and supplies us with the tools of cryptographic technology, it provides us with the ability to digitally sign documents or transactions, or to verify the signatures of others. It enables us to make documents or transactions only readable by those that we designate. Because Digital Certificates bind a public key to an individual or organisation, in a trusted manner, we can be sure of the identities behind these operations. Who needs a Digital Certificate? Anyone who wants to be able to access their company systems such as network shares and intranet sites securely using an ipad or iphone. Can I use my certificate issued by Trustis for other purposes? Currently the primary, and only, purpose of the TMDCS certificate is for secure access to your company network. What security and assurance standards does Trustis use for TMDS certificate services? Trustis provides digital certificates from specialist secure facilities. The facilities and services it provides are approved and/or externally audited to ISO 27001,

4 Which web browsers are supported for use with administration portal? Microsoft Windows 7 using Microsoft Internet Explorer (MSIE), version 8 Microsoft Windows Vista using MSIE, version 7 and above Microsoft Windows XP using MSIE, version 6 and above Mozilla Firefox, version 3.5 and above. Safari How do I collect my certificate? <enter URL here> What about Cookies? The TMDCSservice uses cookies during the application and collection stages. Where cookies are used, they are only First Party Session cookies. This means that they are required only for the period of your interaction with our services and expire at the end of your session with us. We do not allow cookies from others, termed Third Party Cookies and we do not use Persistent Cookies. For the technically minded, session cookies are used as part of the Microsoft ASP technology we use. Some parts of our services require you to accept these cookies and our test pages indicate this and allow you to test that your browser is configured appropriately. Further information on cookies can be found at: de/cookies.aspx Which Apple devices are compatible? ipad 1, 2 and 3 iphone 3gs, 4 and 4s Is there any way to back up my certificate? You cannot specifically backup the certificate but if you have set your device to back up to icloud or to a local installation of itunes then your certificate will be backed up as part of it.

5 I am prompted for a password when trying to install my certificate. If you have a system password setup on your device then you will be prompted for it when the certificate needs to install. How do I check that my certificate is installed and verified? Goto Settings General Profiles and select the certificate you wish to check. If it states Verified then your certificate has been installed correctly If I purchase a new device how do I transfer the certificate? If you select restore from a previous backup when you set the device up and you select a backup that was used for your old device it will restore all of your settings, including your certificate. If you do not have a backup then you will need to request one from your system administrator.