PKI Flashcards
process of verifying authenticity of a newly received digital certificate. Such process involves checking all the certificates in the chain of certificates from a trusted root CA, through any intermediate CAs, down to the certificate issued to the end user.
certificate chaining
Copies of lost private encryption keys can be retrieved from a key escrow by recovery agents. Recovery agent is an individual with access to key database and permission level allowing him/her to extract keys from escrow. TRUE OR FALSE
True
A trusted third-party storage solution providing backup source for cryptographic keys is referred to as:
Key Escrow
deprecated security mechanism designed to defend HTTPS websites against impersonation attacks performed with the use of fraudulent digital certificates?
Public key pinning
allows for checking digital certificate revocation status without contacting Certificate Authority (CA)?
stapling
Encoded in text (ASCII Base64) format, .p7b file extension, Generally used for Microsoft windows and Java Tomcat servers, used for single sign on - what digital certificate format is this?
P7B
Encoded in text (ASCII Base64) format, .pem, .crt, .cer and .key file extensions, Generally used for Apache servers or similar configurations, privacy enhanced mail - what digital certificate format is this?
PEM
What are the characteristics of DER (Distinguished Encoding Rules)?
Encoded in binary, .der/.cer file extension, generally used for java servers
A digital certificate which allows multiple domains to be protected by a single certificate is known as:
SAN - Subject Alternative Name
digital certificate type allows multiple subdomains to be protected by a single certificate?
Wildcard Certificate
In a digital certificate, ________ describes a device, an individual, an organization, or any other entity the certificate has been issued for. In an SSL certificate, _______ refers to the Fully Qualified Domain Name (FQDN), which is the domain name of the server protected by the SSL certificate.
CN Common Name
method for requesting a digital certificate?
CSR Certificate Signing Request
What is the fastest way for checking the validity of a digital certificate?
OCSP Online Certificate Status Protocol
What is OCSP
Online Certificate Status Protocol - allows you to determine the revocation status of a digital certificate using its serial number
What is CRL ?
Certificate Revocation List - list of digital certificates that have been revoked
What is the PKI role of Registration Authority (RA)?
Accepting requests for digital certificates, Authenticating the entity making the request
A type of trusted third party that issues digital certificates used for creating digital signatures and public-private key pairs is known as:
CA - Certificate Authority
hierarchical system for the creation, management, storage, distribution, and revocation of digital certificates
PKI
What is web of trust?
- Decentralized trust model that addresses issues associated with the public
authentication of public keys within a CA based PKI system - Uses peer to peer model
- Certificates are cerated as self signed certificates
What is PFX?
Personal info exchange
What is BER?
Basic Encoding Rules - Original ruleset governing the encoding of data structures for certs where several different encoding types can be utilized
A certificate that requires only the server to be validated
Single Sided Certificate
A certificate that requires both the server and the user to be validated
Dual Sided Certificate
Which is more secure: single or dual sided certificates?
Dual Sided
What is the standard used for PKI digital certificates and contains the owner/user info and the certificate authority’s information?
X.509
What is a Key recovery agent?
Software or individual that allows the restoration of lost or corrupted keys
What is Key Escrow?
when a secure copy of users private key is held in case the user accidentally loses their key
What is a Digital Certificate?
Digitally signed electronic documents that bind a public key with a user’s identity
What is code signing?
Using a digital signature to provide an assurance that software code has not been modified after it was submitted by a developer
What is a Digital Signature?
Digital signatures prevent collisions from being used to spoof the integrity of a message by hashing a file then taking that hash and encrypting it with a private key
Difference between digital certificate and digital signature….
A digital certificate is a digitally signed electronic document that binds a public key with a user’s identity
A digital signature is a hash of a file that is encrypted with a private key in order to prevent collisions and spoofing the integrity of a file/message
