Cryptography for Network and Information Security
Cryptography for Network and Information Security |
|
Digital certificates, similar to identification cards, are electronic credentials that are used to certify the online identities of individuals, organizations, and computers. Certificates are issued and certified by CAs. PKIX-compliant public key infrastructures support industry standard X.509 version 3 certificates.
Digital certificates function similarly to identification cards such as passports and drivers' licenses. Identification cards are issued by recognized government authorities. When someone requests an identification card, a government authority verifies the identity of the requester, certifies that the requester meets all requirements to receive the card, and then issues the card. When an identification card such as a driver's license is presented to others, they can verify the identify of its owner because the card provides the following security benefits:
Like a driver's license, digital certificates are issued by CAs to provide proof for verifying the identity of online entities. However, instead of containing a photograph and the signature of the certificate's owner, a certificate binds the owner's public key to the owner's private key.
A certificate contains information that identifies the certificate's owner (called the subject) as an entity on the network. A certificate also contains the owner's public key. Furthermore, a certificate identifies the CA (called the issuer) that issued the certificate. A CA uses its private key to digitally sign each certificate it issues. To create the digital signature, the CA generates a message digest from the certificate, encrypts the digest with its private key, and includes the digital signature as part of the certificate. Anyone can use the message digest function and the CA's public key to verify the certificate's integrity. If a certificate becomes corrupted or someone tampers with it, the message digest for the altered certificate does not match the digest in the CA's digital signature. Figure 14.8 shows how a certificate is signed by the issuing CA.
Figure 14.8 Digital Signature for a Certificate
A certificate is public information that is available to anyone. Certificates are commonly distributed by means of directories, public folders
PKIX-compliant public key infrastructures, including the public key infrastructure in Windows 2000, support X.509 version 3 certificates. Figure 14.9 shows the contents of X.509 version 3 certificates.
Figure 14.9 X.509 Version 3 Certificate
The contents of X.509 version 3 certificates are described in Table 14.1.
Table 14.1 Description of X.509 Version 3 Certificate Contents
| Certificate Field | Description |
|---|---|
| Version | Version of the certificate format; for example, version 3. |
| Certificate Serial Number | The unique serial number that is assigned by the issuing CA. The CA maintains an audit history for each certificate so that certificates can be traced by their serial numbers. Revoked certificates also can be traced by their serial numbers. |
| Certificate Algorithm Identifier | The public key cryptography and message digest algorithms that are used by the issuing CA to digitally sign the certificate. |
| Issuer | The name of the issuing CA. The name can be listed in one or more of the following formats: X.500 directory name, |
| Validity Period | The certificate's start and expiration dates. These define the interval during which the certificate is valid, although the certificate can be revoked before the designated expiration date. |
| Subject | The name of the subject (owner) of the certificate. The name can be listed in one or more of the following formats: X.500 directory name, |
| Subject Public-Key Information | The public key and a list of the public key cryptography algorithms. The algorithms are for the tasks for which the public key set can be used, such as digital signing, secret key encryption, and authentication. |
| Issuer Unique Identifier | Optional information for uniquely identifying the issuer, when necessary. |
| Subject Unique Identifier | Optional information for uniquely identifying the subject, when necessary. |
| Extensions | Additional information that can be specified for optional use by public key infrastructures. Common extensions include a list of specific uses for certificates (for example, S/MIME secure mail or IPSec authentication), CA trust relationship and hierarchy information, a list of publication points for revocation lists, and a list of additional attributes for the issuer and subject. |
| Certification Authority's Digital Signature | The CA's digital signature, which is created as the last step in generating the certificate. |
X.509 version 3 certificates contain information in the Subject Public-Key Information field that specifies the cryptography operations for which the public key and private key set can be used. Public key security systems commonly support the following basic cryptography operations:
The public key and private key set can be used to provide a variety of specific security functions for information security technologies. These specific functions of certificates are listed in the Extensions field. Common specific security functions for public key technology include the following:
