Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COSC362 > Lecture 15: PKI and Certificates > Flashcards

Lecture 15: PKI and Certificates Flashcards

1
Q

What do public key infrastructures imply?

A

The use of public digital certificates

Digital signatures provide these certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What types of certificates are standardised and used in most network security applications

A

X.509 certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Give NIST’s definition of a public key infrastructrue

A

the key management environment for public key information of a public key cryptographic system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is key management concerned with?

A

The lifecycle of cryptographic keys –> generation, distribution, storage and destruction of keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What legal or business (trusted) entities may be involved in PKI?

A

1) registration authorities (RAs)
2) validation authorities (VAs)
3) certification authorities (CAs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What do registration authorities do i.t.o PKIs?

A

vouching for the identity of a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does PKI stand for?

A

public key infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What do validation authorities do i.t.o PKIs?

A

verify that identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What do certification authorities do i.t.o PKIs?

A

issuing digital certificates (certifying the public key of the user)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How can we be confident of the correct binding between a public key and its owner?

–> e.g. when using a public key to encrypt a message or to verify a digital signature

A

achieved through using digital certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What do digital certificates contain?

A

1) public key
2) owner identity
3) signature alg
4) validity period
….

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who signs digital certificates?

A

certification authority (CA)

–> CA should be trusted by the certificate verifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does a CA do?

A

creates, issues and revokes certificates for subscribers and other CAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does CA stand for?

A

certification authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What must a CA have?

A

a certification practice statement (CPS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does CPS stand for?

A

certification practice statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What issues does a CPS cover?

A

<strong>1)</strong> checks performance before certificate issue
<strong>2)</strong> physical, personnel and procedural security controls for the CA
<strong>3)</strong> technical and key pair protection and management controls
<strong>4)</strong> certificate revocation management procedures
<strong>5)</strong> accreditation info
<strong>6)</strong> legal and privacy issues and liability limitations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Outline the X.509 standard

A

Most widely used certificate standard

Originally ITU standard
Now RFC 5280

Current version (3) allows flexible extensions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the important fields in X.509 certificates? (8)

A

1) version number
2) serial number (set by CA)
3) signature algorithm identifier (alg used to digitally sign)
4) issue name (of the CA)
5) subject name (of the user to which the certificates is issued
6) public key info
7) validity period
8) digital signature (of the certificate, generated by CA)

20
Q

Explain the digital certificate example on slide 10 in set 15

A

See slide 10 in set 15

21
Q

Explain the digital certificate example on slide 11 in set 15

A

See slide 11 in set 15

22
Q

How do you verify a certificate?

A

1) by checking that the CA’s signature is valid

2) by checking that any conditions set in the certificate are correct

23
Q

What must be done in order to verify a certificate?

A

The user of the certificate must have the correct public key of the CA

24
Q

Does it matter how the user obtains the certifcate?

A

no

25
Q

Can public directories store certificates?

A

Yes

Often, the owner of the public key sends the certificate to the user

26
Q

How is a certification path set up?

A

Suppose that the public key of the CA ca0 is not already known and trusted

Then, ca0’s public key can be certified by another Ca ca1

In turn, ca1’s public key can be certified by another CA ca2

Thus, a chain of trust is set up, known as certification path

can –> … –> ca2 –> ca1 –> ca0

27
Q

Given that an entity has a copy of can’s public key and a chain of trust exists between can and ca0, how does obtain a trusted copy of ca0’s public key?

A

The chain of trust is used with certificates for all intermediate CAs to obtain a trusted copy of ca0’s public key

28
Q

Explain the process of a phishing attack

A

See slide 14 in set 15

29
Q

What is an extended validation certificate?

A

Signed by specific intermediate CA

30
Q

What is the browser indication of an extended validation certificate?

A

A colour in the address bar to indicate that the certificate has been issued at a specified level

No technical difference between the certificate

31
Q

What is revocation of a digital certificate?

A

Declaring a certificate invalid even though its validity period is current

32
Q

Who has to check which certificates have been revoked?

A

the user

33
Q

What is the CRL?

A

each CA periodically issues a list of revoked certificates which can be downloaded and then checked by clients before using a certificate

34
Q

What does CRL stand for?

A

certification revocation list

35
Q

What is the OCSP?

A

a server maintains a current list of revoked certificates and responds to request about specific certificates

36
Q

What does OCSP stand for?

A

online certificate status protocol

37
Q

What does public key pinning allow browsers to do?

A

fix a certain time the public key used to verify certificates for certain sites

38
Q

What does public key pinning prevent?

A

attacks due to compromised CAs

39
Q

What browsers support public key pinning?

A

Firefox and others

Previously supported by Chrome, but Google announced to remove it in 2017

40
Q

Explain hierarchical PKI

A

Top to bottom:

Root CA
Intermediate CAs
Users

A CA certifies the public key of the entity below

See the tree diagram on slide 19 in set 15

41
Q

In a non-hierarchical PKI, how is certification done?

A

certification done between any CAs

–> X can certify Y’s public key, or Z can certify Y’s public key –> like path example

42
Q

Explain the browser PKI

A

Multiple hierarchies with preloaded public keys as root CAs

Intermediate CAs can be added

Users can also add their own certificates

Most servers send their public key and certificates to the browser at the start of a secure communication using TLS protocol

43
Q

Where is OpenPGP PKI used?

A

Used in email security e.g. P2P NW

44
Q

What does the certificate in OpenPGP PKI include?

A

ID, public key, validity period, self-signature

45
Q

Does OpenPGP PKI have certification authorities?

A

NO
Keys signed by anyone

certified by as many pairs as possible

46
Q

Where are the keys stored in OpenPGP PKI?

A

various key servers

47
Q

What is OpenPGP PKI often known as?

A

web of trust

COSC362 (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions