Lesson 6 - Implementing Public Key Infrastructure

Question 1

Framework of certificate authorities, digial certificates, software, services, and other cryptographic components deployed for the purpose of validating subject identities.

Answer 1

Public key infrastructure (PKI).
Public key cryptography solves the problem of distributing encryption keys when you want to communicate securely with others or authenticate a message that you send to others.

Question 2

A server that guarantees subject identities by issuing signed digital certifcate wrappers for their public keys.

Answer 2

certificate authority (CA).
The entity responsible for issuing and guaranteeing certificates.

Question 3

Critical PKI concept, and shows how users and different CAs are able to trust one another.

Answer 3

The trust model i

Question 4

A method of validating a certificate by tracing each CA that signs the certificate, up through the hierarchy to the root CA. Also referred to as chain of trust.

Answer 4

certificate chaining, or a chain of trust

Question 5

In PKI, a CA that is available to accept and process certificate signing requests, publish certificate revocation lists, and perform other certificate management tasks.

Answer 5

online CA

Question 6

In PKI, a CA (typically the root CA) that has been disconnected from the network to protect it from compromise.

Answer 6

offline CA

Question 7

A Base64 ASCII file that a subject sends to a CA to get a certificate.

Answer 7

certificate signing request (CSR).
The CSR is a Base64 ASCII file containing the information that the subject wants to use in the certificate, including its public key.

Question 8

In PKI, an authority that accepts requests for digital certificates and authenticates the entities making those requests.

Answer 8

registration authorities (RAs).
These entities complete identity checking and submit CSRs on behalf of end users, but they do not actually sign or issue certificates.

Question 9

An X.509 digital certificate is issued by a Certificate Authority (CA) as a guarantee that a public key it has issued to an organization to encrypt messages sent to it genuinely belongs to that organization.

Answer 9

digital certificate.
Attributes:
Serial number - A number uniquely identifying the certificate within the domain of its CA.
Signature algorithm - The algorithm used by the CA to sign the certificate.
Issuer - The name of the CA.
Valid from/to - Date and time during which the certificate is valid.
Subject - The name of the certificate holder, expressed as a distinguished name (DN).Within this, the common name (CN) part should usually match either the fully qualified domain name (FQDN) of the server or a user email address.
Public key - Public key and algorithm used by the certificate holder.
Extensions - V3 certificates can be defined with extended attributes, such as friendly subject or issuer names, contact email addresses, and intended key usage.
Subject alternative name (SAN) - This extension field is the preferred mechanism to identify the DNS name or names by which a host is identified.

Question 10

Series of standards defining the use of certificate authorities and digital certificates.

Answer 10

Public Key Cryptography Standards (PKCS)

Question 11

An X500 attribute expressing a host or user name, also used as the subject identifier for a digital certificate.

Answer 11

common name (CN)

Question 12

Field in a digital certificate allowing a host to be identified by multiple host names/subdomains.

Answer 12

subject alternative name (SAN)

Question 13

A document that defines the different types of certificates issued by a CA.

Answer 13

Certificate policies.
A certificate type is set by configuring the the Key Usage attribute. The Extended Key Usage (EKU) field—referred to by Microsoft as Enhanced Key Usage—is a complementary means of defining usage.

Question 14

A digital certificate that guarantees the identity of e-commerce sites and other websites that gather and store confidential information.

Answer 14

server certificate

Question 15

Proving the ownership of a particular domain.

Answer 15

Domain Validation (DV)

Question 16

Subjecting to a process that requires more rigorous checks on the subject’s legal identity and control over the domain or software being signed.

Answer 16

Extended Validation (EV).
An EV certificate cannot be issued for a wildcard domain.

Question 17

The method of using a digital signature to ensure the source and integrity of programming code.

Answer 17

code signing certificate.
Issued to a software publisher, following some sort of identity check and validation process by the CA.

Question 18

In PKI, a CA that issues certificates to intermediate CAs in a hierarchical structure.

Answer 18

root certificate.
The root certificate is self-signed.
A root certificate would normally use a key size of at least 2048 bits.
Many providers are switching to 4096 bits.
The CN for a root certificate is set to the organization/CA name, such as “CompTIA Root CA,” rather than an FQDN.

Question 19

A digital certificate that has been signed by the entity that issued it, rather than by a CA.

Answer 19

self-signed certificate

Question 20

A means of limiting access to critical encryption keys such as the private key of a root CA. At least M of the total number (N) of authorized individuals must be present to access the key.

Answer 20

M-of-N control.
Another way to use M-of-N control is to split a key between several storage devices (such as three USB sticks, any two of which could be used to recreate the full key).

Question 21

In key management, the storage of a backup key with a third party.

Answer 21

Escrow

Question 22

A list of certificates that were revoked before their expiration date.

Answer 22

certificate revocation list (CRL).
A revoked certificate is no longer valid and cannot be “un-revoked” or reinstated.
A suspended certificate can be re-enabled.

Question 23

Allows clients to request the status of a digital certificate, to check whether it is revoked.

Answer 23

Online Certificate Status Protocol (OCSP)

Question 24

Mechanism used to mitigate performance and privacy issues when requesting certificate status from an OCSP responder.

Answer 24

OCSP stapling

Question 25

A deprecated method of trusting digital certificates that bypasses the CA hierarchy and chain of trust to minimize man-in-the-middle attacks.

Answer 25

Pinning

Question 26

Embedding the certificate data in the application code, or by submitting one or more public keys to an HTTP browser via an HTTP header.

Answer 26

HTTP Public Key Pinning (HPKP).
HPKP has serious vulnerabilities and has been deprecated.
Replaced with Certificate Transparency Framework.

Question 27

The binary format used to structure the information in a digital certificate.

Answer 27

Distinguished Encoding Rules (DER)

Question 28

7-bit code page mapping binary values to character glyphs.

Answer 28

ASCII.
Standard ASCII can represent 127 characters, though some values are reserved for non-printing control characters.

Question 29

Base64 encoding scheme used to store certificate and key data as ASCII text.

Answer 29

Privacy-enhanced Electronic Mail (PEM)

Question 30

Three character file extension

Answer 30

a convention.
not a standard.
do not always map cleanly to the type of encoding used within a certificate file, or even to the contents of a certificate file.
Both .DER and .PEM can be used as file extensions, although the latter is not recognized by Windows. .PEM is the the most widely used extension for ASCII format files in Linux.
The .CRT and .CER extensions can also be used, but they they are not well-standardized. Most of the confusion arises from the way Windows handles certificates. In Linux, .CRT is most likely to represent an ASCII certificate. In Windows, the most common extension is .CER, but this does not tell you whether the file format is binary or ASCII.

Question 31

Format that allows a private key to be exported along with its digital certificate.

Answer 31

PKCS #12 format.
This would be used either to transfer a private key to a host that could not generate its own keys, or to back up/archive a private key.
Usually password-protected and always binary.

Question 32

Windows file format for storing a private key and certificate data.

Answer 32

.PFX extension.
The file can be password-protected.
MacOS and iOS use .P12.
In Linux, the certificate and key are usually stored in separate files.

Question 33

The stages in a key’s life cycle

Answer 33

Generation
Certificate generation
Storage
Revocation
Expiration and renewal

Question 34

Signing and encrypting email messages is done with an email certificate, typically using

Answer 34

Secure/Multipurpose Internet Mail Extensions (SMIME) or Pretty Good Privacy (PGP)