Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COMPTIA - Sec+ Textbook > Lesson 5: Implementing Public Key Infrastructure > Flashcards

Lesson 5: Implementing Public Key Infrastructure Flashcards

1
Q

public key infrastructure (PKI)

A
  • digital certificates and public key infrastructure (PKI) are critical to manage identification, authentication, and data confidentiality across most private and public networks
  • basic building blocks of PKI include digital certificates and certificate authorities
  • aims to prove that owners of public keys are who they say they are
  • under PKI, anyone issuing public keys should obtain a digital certificate
  • validity of certificate is guaranteed by a certificate authority (CA)
  • validity of CA can be established using various models
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

digital certificate

A
  • essentially a wrapper for a subject’s public key

contains:

  • public key
  • info about the subject and the certificate’s issuer or guarantor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

object identifiers (OIDs)

A

certificate fields

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

public certificates

A
  • use standard extensions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

private certificates

A
  • use private, proprietary, or custom extensions, but may need dedicated or adapted client and server software to interpret them correctly
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

key usage

A
  • one of the most standard extensions

- extension defines purpose for which a certificate was issued, such as signing documents or key exchange

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Extended Key Usage (EKU)

A
  • typical values used include Server Authentication, Client Authentication, Code Signing, or Email Protection
  • more flexible than the Key Usage Field
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

T or F. An extension can be tagged as critical.

A

True.

  • this means that application processing certificate must be able to interpret extension correctly; otherwise the certificate should be rejected
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Distinguished Encoding Rules (DER)

A

all certificates use this as an encoding scheme to create a binary representation of information in the certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

certificate authority

A

person or body responsible for issuing and guaranteeing certificates

functions:

  • provide range of certificate services useful to community of users serviced by CA
  • ensure validity of certificates and identity of those applying for them (registration)
  • establish trust in CA by users and government and regulatory authorities and enterprises, such as financial institutions
  • manage servers (repositories) that store and administer the certificates
  • perform key and certificate lifecycle management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

registration

A

process by which end users create an account with the CA and become authorized to request certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Certificate Signing Request (CSR)

A

when a subject wants obtain a certificate, it completes a CSR, and submits it to the CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

registration authorities (RAs)

A

registration function may be delegated by CA to one or more RAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

certificate policies

A

define different uses of certificate types issued by CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

server certificate

A

guarantees the identity of e-commerce sites or any sort of website to which users submit data that should be kept confidential

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Domain Validation (DV)

A
  • proving the ownership of a particular domain
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Extended Validation (EV)

A
  • subjecting to a process that requires more rigorous checks on the subject’s legal identity and control over the domain or software being signed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Subject Alternative Name (SAN)

A
  • subdomains are listed as extensions

- if a new subdomain is added, a new certificate must be issued

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Wildcard domain

A
  • certificate is issued to the parent domain and will be accepted as valid for all subdomains (to a single level)
  • wildcard certificates cannot be issued with Extended Validation (EV)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

T or F. It might be necessary to issue certificates to machines (servers, PCs, smartphones, and tablets), regardless of function.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

email certificate

A
  • can be used to sign and encrypt email messages, typically using S/MIME or PGP
22
Q

user certifcate

A
  • on a directory-based local network, such as Windows Active Directory, there may be need for a wider range of user certificate types
  • example:
  • standard users
  • administrators
  • smart card logon/users
  • recovery agent users
  • Exchange mail users (with separate templates for signature and encryption)
23
Q

code signing certificate

A

issued to software publisher following some sort of identity check and validation process by the CA

24
Q

root certificate

A
  • one that identifies CA itself

- self-signed

25
Q

self-signed certificate

A
  • any machine, web server, or program code can be deployed with a self-signed certificate
  • self-signed certificates will be marked as untrusted by the operating system or browser, but an administrative user can choose to override this
26
Q

to install a CA hierarchy

A
  1. set up root CA or contract with third-party vendor to provide root CA services
  2. create and issue a self-signed root certificate from the root CA
  3. install subordinate CAs
  4. sign all necessary subordinate CA certificates using the root certificate
  5. secure the root by CA by taking it offline
  6. install further levels of issuing CAs according to your trust model design plan
27
Q

key management

A

refers to the operations at various stages in a lifecycle

28
Q

key’s lifecycle stages

A
  • key generation:
  • creating a secure key pair of the required strength, using the chosen cipher
  • certificate generation:
  • to identify the public part of a key pair as belong to a subject (user or computer), the subject submits it for signing by the CA as a digital certificate with the appropriate key usage
  • storage:
  • user must take steps to store the private key securely, ensuring that unauthorized access and use is prevented
  • revocation:
  • if private key is compromised, it can be revoked before it expires
  • expiration and renewal:
  • a key pair that has not been revoked expires after a certain period
29
Q

T or F. Certificate and key management can represent a critical vulnerability if not managed properly.

A

True

30
Q

If an attacker can obtain a private key…

A

…it puts both data confidentiality and identification/authentication systems at risk

31
Q

If an attacker gains the ability to create signed certificates that appear to be valid…

A

…it will be easy to harvest huge amounts of information from network as user and computer accounts he or she sets up will be automatically trusted

32
Q

If a key used for encryption is accidentally destroyed…

A

…the data encrypted using that key will be inaccessible, unless there is a backup or key recovery mechanism

33
Q

hardware security module (HSM)

A

the process of generating integers that are sufficiently random (not a trivial task) is CPU-intensive, meaning that it often must be undertaken on dedicated hardware

34
Q

T or F. An email user may require multiple key pairs represented by multiple certificates

A

True

35
Q

repository

A
  • once generated, an asymmetric private key or symmetric secret key must be store somewhere safe
  • can be either software- or hardware-based
  • software-based storage
  • key is stored on server
  • hardware-based storage and distribution
  • implemented using removable media, a smart card, or at the higher end, a dedicated key storage hardware security module (HSM)
  • example:
  • smart card
  • USB device
  • subscriber identity module (SIM) card (used with smartphones)
  • another option:
  • Trusted Platform Module (TPM) chip in a PC or a laptop to generate, store, and protect key material
36
Q

M-of-N control

A
  • means that N number of administrators permitted to access the system, M must be present for access to be granted
  • M must be greater than 1, and N must be greater than M
  • example:
  • when m=2 and n=4, any two of four administrators must be present
37
Q

Key Recovery

A

defines a secure process for backing up keys and/or recovering data encrypted with a lost key

38
Q

escrow

A
  • something is held independently

- in terms of key management, this refers to archiving a key (or keys) with a third party

39
Q

revoked

A
  • a key (or more typically, a digital certificate) may be revoked or suspended
40
Q

suspended

A
  • a suspended key can be re-enabled
41
Q

certificate revocation list (CRL)

A
  • CA maintain CRL of all revoked and suspended certificates, which can be distributed throughout hierarchy
  • CRL attributes:
  • publish period - date and time on which CRL is published
  • distribution point(s) - location(s) to which the CRL is published
  • validity period - period during which the CRL is considered authoritative
  • signature - CRL is signed by CA to verify its authenticity
42
Q

Online Certificate Status Protocol (OCSP) or OCSP responder

A
  • another means of providing up-to-date information is to check certificate’s status on OCSP or OCSP responder
  • communicates status of requested certificate
43
Q

OCSP stapling

A
  • OCSP responder issue:
  • privacy issue as the OCSP responder could be used to monitor and record client browser requests
  • OCSP stapling resolves these issues by having the SSL/TLS web server periodically obtain a time-stamped OCSP response from the CA
44
Q

trust model

A
  • critical concept in PKI

- trust model shows how users and different CAs are able to trust one another

45
Q

single CA

A
  • in this simple model, a single CA issues certificates to users; users trust certificates issued by that CA and no other
  • problem:
  • single CA server is very exposed
  • if it is compromised, the whole PKI collapses
46
Q

hierarchical (intermediate CA)

A
  • in this model, a single CA (called the root) issues certificates to several intermediate CAs
  • issues certificates to subjects (leaf or end entities)
  • each leaf certificate can be traced back to the root CA along the certification path (also referred to as certificate chaining or a chain of trust)
  • root’s certificate is self-signed
  • problems:
  • single point of failure (if the root is damaged or compromised, the whole structure collapses)
    ^^ to mitigate against this, however, the root server can be taken offline as most of the regular CA activities are handled by the intermediate CA servers
  • limited opportunity for cross-certification
  • advantage:
  • different intermediate CAs can be set up with different certificate policies, enabling users to perceive clearly what a particular certificate is designed for
47
Q

online CA

A
  • one that is available to accept and process certificate signing requests, publish certification revocation lists, and perform other certificate management tasks
48
Q

offline CA

A
  • because of the high risk posed by compromising the root CA, a secure configuration involves making the root an offline CA
  • offline CA means that it is disconnected from any network and usually kept in a powered-down state
49
Q

certificate pinning

A

refers to several techniques to ensure that when a client inspects the certificate presented by a server or a code-signed application, it is inspecting the proper certificate

50
Q

Pretty Good Privacy (PGP)

A
  • popular open standard for email communications and which can also be used for file and disk encryption
  • exists in two versions:
  • PGP Corporation develops a commercial product
  • OpenPGP open and broadly compatible
51
Q

revoke certificates

A

steps:

  1. revoke certificate itself
  2. publish CRL if your CA relies on it
  3. destroy revoked certificate if it has been stored as a file. If the certificate was stored on a smart card or other portable storage device, destroy or securely wipe the device

COMPTIA - Sec+ Textbook (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions