Lecture 8 - Certificates

Question 1

What is the Attack Based on Public Key, Details of the Attack & can you draw the attack diagram?

Answer 1

• Man-in-the-middle attack
• The public key stored in a server (for instance) may be hacked, or replaced during transmission
• Attacker replaces it with the public key of a keypair generated by him
• Attacker can then intercept the (encrypted) message and decrypt with his matching private key
• He can also re-encrypt the (possibly modified) message with Bob’s (real) public key and send it along
• Similar attack for authentication (need sender’s public key to decrypt)

Question 2

What is the solution to attacks on public keys systems, explain what it is and draw a diagram about it?

Answer 2

• Solution: Certificate
• Concretely, a certificate is a signed file:
• Containing the public key of a subject, some information about the subject, and some information about the issuer of the certificate
• This is signed by the private key of the issuer (a trusted entity)

Question 3

How to Use Certificates and draw the diagram?

Answer 3

• Obtains the certificate, decrypts it with the issuer’s (trusted entity’s) public key
• Digest protects public key from modification

Question 4

Do Certificates Work & Does this really solve the problem?

Answer 4

• Depends on the trustworthiness of the certificate issuer
• Does this really solve the problem?
  
  • To decrypt the certificate, you need the issuer’s public key. How to ensure you get this key securely?
  • Solution: Certification Authority

Question 5

What are Certificate Chains and Authorities?

Answer 5

• Certificate chains
  
  • Another certificate to certify this issuer’s public key
  • Yet another certificate to certify this public key
    ​
• Certification Authority (CA): the final answer
  
  • “Big companies” e.g. VeriSign
  • Self-signed certificates
  • Embedded in browsers

Question 6

What is Certificate Revocation?

Answer 6

• Certificate may be revoked prior to its expiry
  
  • Private key of user compromised
  • Identity of user is forged
  • CA’s private key is compromised
• CAs keep and publish a Certificate Revocation List of all revoked certificates