465 CS Computer Security
Kent Seamons
Certificates
B ack g ro u n d
A c er ti f i c ate w as or i g i nal l y c r eated to b i nd a su b j ec t to th e su b j ec t' s p u b l i c k ey I ntend ed to sol v e th e k ey d i str i b u ti on p r ob l em f or p u b l i c k ey s b y nar r ow i ng th e p r ob l em to th e sec u r e d i str i b u ti on of th e C A p u b l i c k ey
5 @9 6 7 4 & " & % '# % B 7 " ) 8 2 3 & 40 ) # & 0 1 ! % $ A ) " % ( ! % ) 7 $ ) " " $ ! $ & ( '
5
5
5
Certificate authority (CA) I s s uer
) & " ! " #
D efin itio n s
Public Key Infrastructure (PKI) E x p iratio n V alid ity p erio d o f th e certificate C ertificate R ev o catio n L ist (C R L )
R elying p arty R ecip ient o f a certificate w h o relies o n info rm atio n v erified using th at certificate
Certificate Hierarchy
Trusted root C erti f i c a te p a th W h a t i f a D ep a rtm en t c erti f i a c te i s revoked? How is the hierarchy rep aired?
a ` Y " $ 5 'C 0 d e c f g 9 'G 6 F H0 C II ' D6 0P T RSQ R 3 RU A 5V ( ! " 7 D CE& A' C 0 F7 $ ) ''( & % ` Y % 75 86 @A9 @ 3 'B 7 @ 0 1 20 1 341 ` c % $ b # X W
Steps to Certificate Verification
What are the steps a web browser (relying party) might tak e to v erif y a c ertif ic ate?
Ownership
Integrity E x p ira tio n R ev o c a tio n U s a ge c o ns tra ints
Required Reading
Ten Risks of PKI C. Ellison and B. S c h ne ie r h t t p : / / w w w . sc h neier . c om / p a p er -p ki. h t m l
Risks
Who do ...