CH26 Public Key Infrastructure

Question 1

What is Public Key Infrastructure (PKI)?

Answer 1

An entire system of hardware, software, policies, procedures, and people that is based on asymmetric encryption

PKI and public key encryption are related but they are not the same thing.
When we are talking about PKI, this is the system that creates the asymmetrical key pairs that consist of those public and private keys that are used in the encryption and decryption process, as well as managing those key pairs to make sure they’re valid and can be trusted.

When we talk about Public Key Cryptography, we are just talking about the encryption and decryption process. It’s a small part of the overall PKI architecture.

Question 2

How does PKI create a secure SSL/TLS tunnel?

Answer 2

a client generates text that it wants to send to a hosting server.
a client encrypts the data using server’s public key.
encrypted message reaches the server.
server decrypts the message using its private key.
the server can read the decrypted content of the message

Question 3

What is a Certificate Authority?

Answer 3

a trusted third party who will issue digital certificates and keep the trust between all of the certificate authorities around the world.

Certificate Signing Request (CSR) is submitted to the CA (certificate authority) to request digital certificate

Question 4

What is Digital Certificates ?

Answer 4

Digitally-signed electronic documents that bind a public key with a user’s identity.

X.509 – Standard used by PKI for digital certificates and contains the owner/users information and the certificate authority’s information

Digital certificates are usually based on the X.509 standard but the certificate itself must be encoded before it can be used.

Question 5

What is Wildcard certificates ?

Answer 5

allow all of the subdomains to use the same public key certificate and have it displayed as valid

Question 6

What does Subject Alternatives Names (SAN) do?

Answer 6

Allows a certificate owner to specify additional domains and IP addresses to be supported

Question 7

What is Single-sided certificate?

Answer 7

only require the server to be validated

Question 8

What is Dual-sided certificate?

Answer 8

require both the server and the user to be validated

Question 9

What are the 3 different encoding methods that are classified under the X.690 standard?

Answer 9

1. Basic Encoding Rules (BER) – original ruleset governing the encoding of data structures for certificates where several different encoding types can be utilized.

For the exam : remember that BER has the ability to have multiple encoding types.

2. Canonical Encoding Rules (CERT) – a restricted version of the BER that only allows the use of only one encoding type.
3. Distinguished Encoding Rules (DER) – Restricted version of the BER which allows one encoding type and has more restrictive rules for length, character strings, and how elements of a digital certificate are stored in X.509

Question 10

What is PEM?

Answer 10

PEM = Privacy-enhanced Electronic Mail (.pem)

digital certificate that is used for the DER encoding method.

File extensions : .pem, .cer, .crt, or .key

Question 11

What is P12?

Answer 11

Public Key Cryptographic System #12 (PKCS#12)

digital certificate that is used to store a server certificate, and intermediate certificate, and a private key in one encrypted file

File extension : .p12

Question 12

What is PFX ?

Answer 12

Personal Information Exchange (.pfx)

Digital Certificate used by Microsoft for release signing

File extension : .pfx

Question 13

What is P7B ?

Answer 13

Public Key Cryptographic Systems #7 (PKCS #7)

Digital Certificate used as a basis for S/MIME, the secure email protocol. Also used as a single sign on.

File extension : .p7b

Question 14

What are the file types associated with PKI ?

Answer 14

For the exam : remember that .pem, .cer, .crt, .key, .p12, .pfx, .p7b file types are associated with PKI.

Question 15

What is Registration Authorities (RA) ?

Answer 15

Used to verify information about a user prior to requesting that a certificate authority issues the certificate.

Question 16

What is Certificate Authority (CA) ?

Answer 16

The entity that issues certificates to user. Verisign, Digisign, and many others act as a Root CA.

All of a CA’s certificates must be revoked if it is compromised

Question 17

What is Certificate Revocation List (CRL) ?

Answer 17

An online list of digital certificates that the certificate authority has revoked.

Question 18

What is Online Certificate Status Protocol (OCSP) ?

Answer 18

A protocol that allows you to determine the revocation status of a digital certificate using its serial number.

Question 19

What is OCSP Stapling?

Answer 19

Allows the certificate holder to get the OCSP record from the server at regular intervals and include it as part of the SSL or TLS handshake

Question 20

What is Public Key Pinning ?

Answer 20

Allows and HTTPS website to resist impersonation attacks by presenting a set of trusted public keys to the user’s web browser as part of the HTTP header

Question 21

What is Key Escrow ?

Answer 21

Occurs when a secure copy of a user’s private key is held in case the user accidently loses their key.

Question 22

What is Key Recovery Agent?

Answer 22

a specialized type of software that allows the restoration of a lost or corrupted key to be performed

Question 23

What is Web of Trust?

Answer 23

Decentralized trust model that addresses issues associated with the public authentication of public keys within a CA-based PKI system. Normally, you have to pay money to get these digital certificates from CA. With web of trust, we use peer-to-peer model instead

In peer-to-peer network, Certificates are created as self-signed certificates. (You can trust me because I said so). You have the option to go ahead and trust me or not.

Pretty Good Privacy (PGP) is web of trust. You are trusting the collective intelligence of others. Everyone who trusts you starts to help increase your rating which becomes a basis for others to trust as well.