Module 4 - PK Infrastructure

structure that provides all of the necessary components
for different types of users and entities to be able to

communicate securely and in a predictable manner
made up of hardware, applications, policies, services,

programming interfaces, cryptographic algorithms,
protocols, users, and utilities
How PKI works:
What does the “infrastructure” in “public key
infrastructure” mean?
❑ An infrastructure provides a sustaining groundwork for other

things to be built upon – network topology and data-link
technologies (Ethernet, Token Ring) that provides network
foundation.
trusted authority for certifying individuals’ identities and creating an
electronic document (digital certificate) indicating that individuals are
who they say they are
made up of software, hardware, procedures, policies, and people who are

involved in validating individuals’ identities and generating the certificates
should have a certification practices statement (CPS)

❑ outlines how identities are verified, the steps the CA follows to generate, maintain,
and transmit certificates, and why the CA can be trusted to fulfill its responsibilities
❑ describes how keys are secured, what data is placed within a digital certificate, and
how revocations will be handled
the component that accepts a request for a digital certificate
and performs the necessary steps of registering and
authenticating the person requesting the certificate
three different types of certificates:

❑ Class 1 – usually used to verify an individual’s identity through e-mail
❑ Class 2 – may be used for software signing
❑ Class 3 – may be used by a company to set up its own certificate
authority
1.
Registration authority
Steps for obtaining a 7.

Digital
digital certificate certificate
6.
User values 2.
Certificate authority
Algorithm
3.
5.
Key store 4.
1.The user registers for a digital certificate.
2.Some method is used to determine random values.
3.An algorithm generates a public/private key pair.
4.The key pair is stored in a key store on the workstation.
5.A copy of the public key and other identifying information is sent
to the CA.
6.The CA generates a digital certificate containing the public key
and the other identifying information.
7.The new certificate is sent to the user.
What is a Repository?
❑ general term that describes a centralized directory that can be
accessed by a subset of individuals
❑ usually LDAP-compliant
What is a Certificate Repository?

❑ holdingplace for individuals’ certificates and public keys that are
participating in a particular PKI environment
Steps for validating a certificate:
1. Compare the CA that digitally signed the certificate to a list of CAs that has
already been loaded into the receiver’s computer.
2. Calculate a message digest for the certificate.
3. Use the CA’s public key to decrypt the digital signature and recover what is
claimed to be the original message digest embedded within the certificate
(validating the digital signature).
4. Compare the two resulting message digest values to ensure the integrity of the
certificate.
5. Review the identification information within the
certificate, such as the e-mail address.
6. Review the validity dates.
7. Check the revocation list to see if the certificate has been revoked.
public key certificate (or identity certificate) that uses a digital signature to bind
together a public key with an identity
issued by a certification authority (CA) that

contains the following:
❑ Name
❑ Serial number
❑ Expiration date
❑ Copy of the certificate holder’s public key
❑ Digital signature of the certificate-issuing authority
created and formatted based on the X.509

standard
Fields within a
digital certificate
Certificate Attributes: CA certificate CA certificate
❑ End-entity certificates Root CA
❑ CA certificates
❑ Cross-certification certificates
❑ Policy certificates CA
End-entity
CA
End-entity
certificates certificates
Router
PDA
Firewall
End-entity and CA certificates

Certificate Extensions:
❑ Standard certificate extensions
❑ Private certificate extensions
Key usage extensions dictate how the public key that is

held within the certificate can be used.
In a centralized infrastructure, the keys are generated and
stored on a central server, and the keys are transmitted to the
individual systems as needed.
In a decentralized infrastructure, software on individual

computers generates and stores cryptographic keys local to
the systems themselves.
Characteristics and requirements of proper
private key use:
❑ The key size should give the needed level of protection for the environment.
❑ The duration of the key should correspond with how frequently it is used and the sensitivity of the
data it is protecting.
❑ The key should be modified and not be used past its allowed lifetime.
❑ Where necessary, the key should be correctly
destroyed at the end of its duration.
❑ They key should never be shown in clear text.
❑ Duplicate copies of the private key should not be made if it is being used for digital signatures.
❑ The key should not be shared.
❑ The key should be stocked securely.
❑ Authentication should be mandatory before it can be used.
❑ The key should be transported securely.
❑ Software implementations that store and use the key should be evaluated to make sure they offer the
needed level of protection.
company that focuses in validating individual identities and creating
and upholding their certificates
publishes certificates that are not bound to particular companies or

inter-company departments
recognized and simple available to many people

preserved, implemented, and controlled by the company that
employed it
can be used to create certificates for in-house employees,

devices, applications, partners, and customers
provide more flexibility for companies

different than public CA in that it offers dedicated
services, and perhaps equipment, to an individual Company A Company B Company C
company
RA
Repository CA CA Repository RA
Company D
CA CA RA
RA Repository Repository
Company E Company F
Hierarchical Trust Model
❑ contains a root CA,
intermediate CAs, leaf CAs,
and end-entities
Peer-to-Peer Model Company A Company B
CA CA
Cross certification
❑ one CA is not subordinate creates a peer-to-peer
to another CA, and there PKI model.
is no established trusted
anchor between the CAs
involved CA
CA CA
Scalability is a CA CA
drawback in cross-
certification models. CA CA
CA
Hybrid Trust Model
❑ two companies have their Bridge
CA
own internal hierarchical
Root Root
models and are connected CA CA
through a peer-to-peer Intermediate Intermediate Intermediate Intermediate

CA CA CA CA
model using cross
Leaf Leaf Leaf Leaf Leaf Leaf Leaf Leaf
certification CA CA CA CA CA CA CA CA
❑ implements a bridge CA Root

CA
Intermediate Intermediate
CA CA
Leaf Leaf Leaf Leaf

CA CA CA CA

Module 4 - PK Infrastructure

Uploaded by

Copyright:

Available Formats

Module 4 - PK Infrastructure

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module 4 - PK Infrastructure

Uploaded by

Copyright:

Available Formats

structure that provides all of the necessary components

for different types of users and entities to be able to

made up of hardware, applications, policies, services,

❑ An infrastructure provides a sustaining groundwork for other

made up of software, hardware, procedures, policies, and people who are

should have a certification practices statement (CPS)

three different types of certificates:

Steps for obtaining a 7.

digital certificate certificate

What is a Certificate Repository?

issued by a certification authority (CA) that

created and formatted based on the X.509

❑ End-entity certificates Root CA

End-entity and CA certificates

Key usage extensions dictate how the public key that is

In a decentralized infrastructure, software on individual

publishes certificates that are not bound to particular companies or

recognized and simple available to many people

can be used to create certificates for in-house employees,

provide more flexibility for companies

through a peer-to-peer Intermediate Intermediate Intermediate Intermediate

❑ implements a bridge CA Root

Leaf Leaf Leaf Leaf

You might also like