10 - Digital Certificates

Question 1

Man in the middle attack (public key context)

Answer 1

For example, change the public key server to have attacker public key then intercept/decrpyt communications and re-encrypt then pass onto the original destination

Question 2

Digital signature think of it as

Answer 2

“I certify that Bob’s public key is …”

Signed by someone trustworthy

Question 3

Public Key Management Issues

Answer 3

• Pub keys have to be distributed
• How do we trust that the key belongs to the person it claims?
• How to revoke a public key? (Compromised private keys for example)
• Keys might have an expiry date

Question 4

Public keys are usually distributed as…

Answer 4

Digital certificates

Question 5

Digital Certificates contain:

Answer 5

• Public Key (and which algo)
• Info on identity of the key owner
• One or more digital signatures from entities confirming the public key belongs to the owner
• other info

Question 6

Methods for distributing public keys for individuals

Answer 6

• Manually or by email etc
• Publish on your webpage
• Certificate servers/directory servers

Question 7

Methods for distributing public keys for organisations

Answer 7

• Public Key Infrastructure (CAs etc)
• ## Once the cert is issues, org can store on own webserver and send to any client

Question 8

Digital Certificate formats

Answer 8

• X.509
• OpenPGP (commonly used by individuals)

Question 9

Publishing to a Certification Authority (and Registration Authority)

Answer 9

• Create key pair
• Submit pub key to CA
• RA associated to the CA verifies the identity (RA is human entity)
• CA issues a certificate which is signed using the CA’s private key.

Question 10

Domain Validation

Answer 10

CA only checks that you control the domain

Question 11

Organisation validation

Answer 11

CA also checks existence of the organisation that claims to own the domain

Question 12

Extended Validation

Answer 12

CA performs extended checks on the org

Question 13

Who issues the certificate of a CA?

Answer 13

• Other CAs in a hierarchical structure
• CAs sign each other certificates
• CAs sign their own certificates

Question 14

Certificate Revocation

Answer 14

If a private key has been compromised, the certificate should be revoked:

• Communicate revocation to CA
• Certificate Revocation Lists (CRL) are posted on cert servers

Question 15

Browsers and CAs

Answer 15

Browsers tore a list of trusted CA’s w/ their certs and public keys.

Question 16

Mediums for storing the private key

Answer 16

• Smartcard/USB Token can be combined with PIN/password or biometric
• Save manually on removeable storage device
• On the compuiter’s hard drive, encrypted with a passphrase. Strength of pass has to be alike to key strength
• allow 3rd party to generate and store keys

Question 17

Storing private keys in high security orgs

Answer 17

Use specialised hardware:
- HSM (HW Sec Module)
- TPM - Trusted Platform Module