Managing Certificates 6

Question 0

Describe certificate authentication

Answer 0

The process of identifying users in a transaction that through a series of steps instead of using a user name and password authentication

Question 1

What is a digital certificate

Answer 1

An electronic document that associates credential with a public key.
The certificate validates the certificate holders identity and is also a way to distribute the holders public key. CA, Certificate Authority issues certificates and the key pairs.

Question 2

What is PKI

Answer 2

Public Key Infrastructure
A system composed of CA, certificates, software, services, and other cryptographic components for the purpose of enabling authenticity and validation of data and entities.
Can be used to secure transactions over the Internet.

Question 3

List the components of PKI

Answer 3

Digital certificates 
One or more CAs
Registration authority, RA
certificate repository database
Certificate management system
CSR, certificate signing request a message sent to a CA on which a resource applies for a certificate

Question 4

What is PKCS

Answer 4

Public Key Cryptography Standards
The most common CSR format
Important standards include
PKCS 7 cryptographic message syntax standard. Describes syntax used for cryptographic data like digital signature.
PKCS 10 verification request syntax standards. describes the syntax used to request certification of a public key a

Question 5

Explain the Root CA

Answer 5

The topmost CA In the hierarchy and is the most trusted authority. Issues and self signs the first certificate in the hierarchy. Must be secured be use if compromised all other certificates become invalid.

Question 6

What are public and private roots

Answer 6

Describes root CAs
Private root CA. Created for use within a company itself.

Public root CA. created by a third party for general access by the public.
Well known VeriSign, GlobalSign, Entrust

Question 7

What is subordinate CAs

Answer 7

Any CA below the root CA

Issues certificates and provide day to day management of the certificates

Question 8

What are offline CAs

Answer 8

Taking the Root CA offline to provide a secure environment. Allows the subordinate CAs to issue all certificates. All updates made to the subordinate CAs. Ensures that the Root CA is not accessible and less likely to be compromised.

Question 9

Describe why certificates must be enrolled

Answer 9

A CA by itself does you no good. Certificate must be enrolled properly for the appropriate entities in order to implement certificate based security.

Question 10

Describe the certificate enrollment process

Answer 10

Must start off with a certificate request
The registration authority authenticates identity
RA applies the certificate policy pertaining to the particular CA that will issue the certificate
If identify authenticated the RA sends the certificate request to the CA
The CA creates the certificate and outs it in the repository
The CA notifies the entity that the certificate is available and the certificate is delivered
When entity obtains it, it is installed

Question 11

Describe the life cycle of the certificate

Answer 11

The life cycle begins when the root CA has issued its self signed key pair. Begins issuing certificates to other CAs and users
Users obtain certificates from the CA through certificate enrollment
Certificates can be renewed more then once depending on certificate policy parameters
Certificates can be revoked before expiring
Certificates expire after a given length of time
If the root CAs certificate expires the entire CA becomes inactive
Some CAs support temporary suspension of certificates and also permanent revocation.

Question 12

For certificate life cycle management compare longer to shorter life cycles.

Answer 12

The longer the life cycle less admin overhead is involved. Poses higher security risk giving attackers more time to break cryptography of the key pair.
Shorter life cycle allows for renewal of more secure certificates.

Question 13

Describe the SSL enrollment process

Answer 13

Client requests a session with the server
Server responds by sending its digital certificate and public key to the client
Server and client negotiate an encryption level
Client generates a session key, encrypts it and sends it with the public key from the servers
The session key then becomes the key used in the communication

Question 14

Why do certificates need to be renewed

Answer 14

Renewal process upholds security and accessibility

Question 15

List private key protection methods

Answer 15

Back it up to removable media and store the media securely
Delete it from insecure media
Require a password to restore the private key
Never share a key
Never transmit a key on the network or across the Internet
Consider using key escrow to store a private key with trusted third parties.

Question 16

What is key escrow

Answer 16

An alternative to key backups
used to store private keys securely while allowing one or more trusted third parties called key escrow agents access to the keys under predefined conditions

Question 17

What is M of N Control used for

Answer 17

Used to prevent a single authorized agent from recovering a key.
Is a mathematical control that takes into account the total number of key recovery agents,n, along with the number of agents required to perform a key recovery,m. If the number of agents attempting to recover a key does not meet or exceed m then the key will not be recovered.

Question 18

Name the two private key restoration methods

Answer 18

In the event a private key is lost or damaged you must restore the key from a backup or from escrow before you can recover any encrypted data

If using key escrow the key is divided among escrow agents. They use the parts to reconstruct the lost key or decrypt the info directly

If the key was backed up to removable media it can be restored from the backup location.

Question 19

Describe the private key replacement process

Answer 19

Recover the private key
Decrypt any encrypted data
Destroy the original private key
Obtain a new key pair
Reencrypt the data using the new private key

Question 20

List some reasons certificates can be revoked before expiring

Answer 20

Certificate owners private key had been compromised or lost
Certificate was obtained by fraudulent means
Certificate holder is no longer trusted.

Question 21

Define the CRL Certificate Revocation List

Answer 21

A list of certificates that were revoked before the expiration date
Each CA has its own CRL that can be accessed trough the directory services of the network os or website.

Question 22

What is OCSP

Answer 22

Online Certificate Status Protocol
An HTTP based alternative to a CRL for checking the status of revoked certificates.
OCSP servers also called responders accept a request to check a specific certificates status. The responder uses the certificates serial number to search for it in the CAs database. The server sends the certificates status to the requester.
The main advantage is it lowers overhead but not secure using http