3.9 Public Key Infrastructure PKI

Question 1

Define CA (3)

Answer 1

1. Certificate Authority
2. Verifies information and signs certificates
3. Provides verification and validation of certificates

Question 2

Define Intermediate CA (2)

Answer 2

1. A CA with a subset of certificates under a CA
2. Limits the scope of CA compromise to only the subset of certificates it contains

Question 3

Define Registration Authority (RA)

Answer 3

1. Decides if Certificate Signature Requests CSRs should be granted after verifying and validating the requestor

Question 4

Define Certificate Revocation List (CRL) (2)

Answer 4

1. A list of certificates that have been revoked and are not valid
2. Certificates may be revoked due to compromise or valid changes/updates

Question 5

Define Online Certificate Status Protocol (OSCP)

Answer 5

Used to expedite the process of validating a certificate, instead of downloading CRL(s) which can be huge

Question 6

Define Certificate Signing Request (CSR)

Answer 6

Final step of creating a valid certificate where the public key is sent to CA/RA to be validated or “signed”

Question 7

Define Common Name (CN) relative to certificates

Answer 7

The fully qualified domain name(s) for which the certificate is valid

Question 8

Define Subject Alternative Name (SAN)

Answer 8

Alternate domain names for which the certificate is valid

Question 9

Define distinguished encoding rules (DER) format for certificates (2)

Answer 9

1. Binary format, typically used with Java
2. Cannot be transferred via email, unless encoded with base64 which translates it to ASCII text, for example

Question 10

Define P12 certificate format (2)

Answer 10

1. Container format capable of storing multiple certificates, useful for transferring both public and private keys
2. Container access can be password protected, allowing secure transfer, especially good for private key transfer

Question 11

Define PFX certificate format (2)

Answer 11

1. Microsoft’s implementation, nearly exactly like P12
2. Used to store private keys

Question 12

Define PEM certificate format (2)

Answer 12

1. Plain ASCII representation of certificate
2. Not secure for transferring private keys

Question 13

Define CER certificate format (2)

Answer 13

1. Used by Windows OS to store public certificates
2. Supports DER and PEM format

Question 14

Define P7B certificate format (3)

Answer 14

1. ASCII text file that can be transferred via email
2. Not secure for transferring private keys
3. Widely supported by multiple OS

Question 15

Define aspects of online CA (2)

Answer 15

1. Best practice is to have intermediate CA with a subset of certificates online in the organization to sign certificates
2. If compromised, only the subset of certificates on it need to be re-issued

Question 16

Define aspects of offline CA (2)

Answer 16

1. Best practice is keep the root CA offline (not network attached) to prevent it from being compromised
2. If online, intermediate CA is compromised, certificates for a replacement CA can be generated from the root CA

Question 17

Define stapling relative to certificates (2)

Answer 17

1. Uses OSCP to eliminate need to check with CA to see if the certificate is revoked
2. Status information for that certificate is digitally signed and stored on the local server and “stapled” to it

Question 18

Define certificate pinning (2)

Answer 18

1. A copy of a certificate is included “pinned” in the source code of an application, such as web browser
2. When application connects to a server, it compares the copy of certificate provided by server to its pinned copy to ensure integrity

Question 19

Define Web of Trust relative to certificates (2)

Answer 19

1. If a certificate comes from an untrusted source, but is signed by a trusted source, you can trust it
2. PGP uses this

Question 20

Define trust escrow relative to certificates

Answer 20

A third-party is trusted with decryption keys

Question 21

Define certificate chaining (2)

Answer 21

1. Validation of a certificate across multiple intermediate CAs before finally reaching a root CA
2. Requires that server must trust all CAs in the chain