Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sec+ > Lesson 6 > Flashcards

Lesson 6 Flashcards

1
Q

PKI

A

• Public key infrastructure (PKI) validates the identity of the owner of a public
key
• Public key is wrapped in a digital certificate signed by a certificate authority
(CA)
• Sender and recipient must both trust the CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Single CA

A

In this simple model, a single CA issues certificates to users; users trust certificates
issued by that CA and no other.

The problem with this approach is that the single CA
server is very exposed. If it is compromised, the whole PKI collapses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

• Hierarchical/chain of trust

A

Root CA (or Single CA)
• Intermediate CAs
• Leaf certificates

The Root CA is still the single point of failure. If the root is damaged or compromised, the whole structure collapses.
To mitigate against this, however, the root server can be taken offline, as most of the
regular CA activities are handled by the intermediate CA servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Registration

A

Registration is the process by which end users create an account with the CA and
become authorized to request certificates. The exact processes by which users are
authorized and their identity proven are determined by the CA implementation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CSR

A
  • Client generates key pair and sends public key to CA with CSR
  • CA performs subject identity checks
  • CA signs and issues certificate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

REgistration Authority (RA)

A

The registration function may be delegated by the CA to one or more registration
authorities (RAs). These entities complete identity checking and submit CSRs on
behalf of end users, but they do not actually sign or issue certificates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Digital Certificate

A

•Essentially a wapper for the subject’s public key
Contains subject’s public key
• Information identifying the subject
plus usage and validity

• Digital certificate standards
•    X.509 Public Key Infrastructure 
(PKIX)
•    PKCS (Public Key Cryptography 
Standards)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Digital Certificate Dandards

A 
• Digital certificate standards
•    X.509 Public Key Infrastructure 
(PKIX)
•    PKCS (Public Key Cryptography 
Standards)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

x.509 standard fields

A

Field Usage - Serial Number A number uniquely identifying the certificate within the domain of its CA.

Signature Algorithm - The algorithm used by the CA to sign the certificate.

Issuer The name of the CA.

Valid From/To Date and time during which the certificate is valid.

Subject The name of the certificate holder, expressed as a distinguished name (DN). Within this, the Common Name (CN) part should usually match either the
fully qualified domain name (FQDN) of the server or a user email address.

Public Key Public key and algorithm used by the certificate holder.

Extensions V3 certificates can be defined with extended attributes, such as friendly
subject or issuer names, contact email addresses, and intended key usage.

Subject Alternative Name (SAN) - This extension field is the preferred mechanism to identify the DNS name or
names by which a host is identified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

• Common Name (CN)

A

• Legacy method of recording FQDN (fully qualified domain name
• Deprecated by standards
• BUT still used in many
implementations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

• Subject Alternative Name (SAN)

A

non legacy (Common Name (CS)) is legacy

  • Structured identifiers
  • List multiple host/subdomains
  • Use wildcard subdomain
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Types of Certificate

A
  • Certificate policicies and templates
  • key usage
  • Extended Key Usage/Enhanced Key Usage
  • Critical or non critical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

server certificate

A

guarantees the identity of e-commerce sites or any sort of website
to which users submit data that should be kept confidential.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Web server Certificate types

A
  • Domain Validation (DV)
  • More rigorous identity checks

• Extended Validation (EV)
• Even more rigorous identity
checks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

• Machine/computer certificates

A
  • Servers and network appliances
  • Identify by FQDN

It might be necessary to issue certificates to machines (servers, PCs, smartphones, and
tablets), regardless of function. For example, in an Active Directory domain, machine
certificates could be issued to Domain Controllers, member servers, or even client
workstations. Machines without valid domain-issued certificates could be prevented
from accessing network resources. Machine certificates might be issued to network
appliances, such as routers, switches, and firewalls. The SAN and often the CN attribute
should be set to the FQDN of the machine (host name and local domain part).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

FQDN

A

Fully qualified domain name

17
Q

• Email/user certificate

A

• Can be various types (email, encryption,
smart card logon, and so on)
• Identify by email address

18
Q

• Code signing

A

• Validate publisher name of the code

19
Q

• Root certificate

A

is the one that identifies the CA itself.

20
Q

Self-signed certificate

A

• Must be manually trusted

Any machine, web server, or program code can be deployed with a self-signed
certificate. Self-signed certificates will be marked as untrusted by the operating
system or browser, but an administrative user can choose to override this.

21
Q

Key lifecycle

A
  • Key generation
  • Certificate generation
  • Storage
  • Revocation
  • Expiration and renewal

Key generation—creating a secure key pair of the required strength, using the
chosen cipher.
• Certificate generation—to identify the public part of a key pair as belonging to a
subject (user or computer), the subject submits it for signing by the CA as a digital
certificate with the appropriate key usage. At this point, it is critical to verify the
identity of the subject requesting the certificate and only issue it if the subject
passes identity checks.
• Storage—the user must take steps to store the private key securely, ensuring that
unauthorized access and use is prevented. It is also important to ensure that the
private key is not lost or damaged.
• Revocation—if a private key is compromised, the key pair can be revoked to prevent
users from trusting the public key.
• Expiration and renewal—a key pair that has not been revoked expires after a certain
period. Giving the key or certificate a “shelf-life” increases security. Certificates can
be renewed with new key material.

22
Q

M-of-N control

A

• M-of-N control for critical keys (root servers)

Access to such critical encryption keys must be logged and audited
and is typically subject to M-of-N control, meaning that of N number of administrators
permitted to access the system, M must be present for access to be granted. M must
be greater than 1, and N must be greater than M. For example, when M = 2 and
N = 4, any two of four administrators must be present. Staff authorized to perform
key management must be carefully vetted, and due care should be taken if these
employees leave the business.

23
Q

Key backup

A
  • Keys can be backed up to protect against data loss
  • Anyone with access to backup keys could impersonate the true key holder
  • Key recovery processes can be protected by M of N control
24
Q

Escrow backup

A

• Placing archived keys with a trusted third party

25
Q

Certerficate expiration, renewal, etc

A
  • Certificate duration
  • Certificate renewal
  • Use existing key pair
  • Re-key with newly generated key pair
  • Expiration
  • Public key will no longer be accepted
  • Archiving versus destroying key material (destroying is more secure)
  • Secure erasing methods
26
Q

Cert revokation vs suspention

A

A revoked certificate is no longer valid and cannot be “un-revoked” or reinstated.

•A suspended certificate can be re-enabled.

27
Q

CRL

A 
Certificate Revocation 
List (CRL)    [not necessarily real-time]
• List of revoked and 
suspended certificates
• Browser CRL checking
28
Q

• Online Certificate Status Protocol (OCSP)

A
  • Provide real-time status information (though some rely on CRLs)
  • Client queries single certificate per transaction
29
Q

• OCSP stapling

A

• Clients might need to make lots of certificate queries for a chain of
trust
• Queries can be used to track clients
• Stapling proxies the OCSP response

30
Q

SSL/TLS

A

SSL is standard technology for securing an internet connection by encrypting data sent between a website and a browser (or between two servers).

TLS: Transport Layer Security
TLS is an updated, more secure version of SSL. We still refer to our security certificates as SSL because it’s a more common term,

31
Q

Certificate Pinning

A

Pinning refers to several techniques to ensure that when a client inspects the
certificate presented by a server or a code-signed application, it is inspecting the
proper certificate.

• Defend against MitM attacks on chain of trust

32
Q

Certificate Formats

A

Slide 22. I skipped this one

33
Q

Open SSL

A

I skipped this one (slide 23)

34
Q

Certificate issues

A

The most common problem when dealing with certificate issues is that of a client
rejecting a server certificate (or slightly less commonly, an authentication server
rejecting a client’s certificate).

  • Existing certificate—check expiry and status
  • New certificate
  • Check key usage settings and requirements
  • Check subject name
  • Check chain of trust/root certificates
  • Verify time and date settings
35
Q

Certificat policies and templates

A

Certificate policies define the different uses of certificate types issued by the CA.
These can be configured as standard certificate templates.

Typical values used include Server
Authentication, Client Authentication, Code Signing, or Email Protection.

36
Q

Key usage

A 
A certificate type is set by configuring the the Key Usage attribute. The Extended
Key Usage (EKU) field—referred to by Microsoft as Enhanced Key Usage—is a
complementary means of defining usage. Typical values used include Server
Authentication, Client Authentication, Code Signing, or Email Protection.
37
Q

Extended Key Usage/Enhanced Key Usage

A

The Extended Key Usage (EKU) field—referred to by Microsoft as Enhanced Key Usage—is a
complementary means of defining usage. Typical values used include Server
Authentication, Client Authentication, Code Signing, or Email Protection. The EKU field
is more flexible than the Key Usage field, but problems can occur when non-standard
or vendor-specific definitions are used.

38
Q

Critical or non critical (Under types of certs)

A

???
An extension can be tagged as critical, meaning that the application processing the
certificate must be able to interpret the extension correctly; otherwise, the certificate
should be rejected. In the case of a Key Usage extension marked as critical, an
application should reject the certificate if it cannot resolve the Key Usage value. For
example, this prevents a certificate issued for encrypting traffic sent to a web server
from being used for signing an email message.

39
Q

wilcard

A

*.example.com
A wildcard certificate is capable of being used by, and protecting, several servers so long as the domain and top level domain are matching.

Sec+ (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions