PKI Cryptography

Question 1

Framework for managing private keys and cert.’s, provides standard for key generation, authentication, distribution and storage; est. who is responsible for authenticating identity of owners of digital cert.’s, follows X.509 standard.

Answer 1

PKI

Question 2

use X.509, defines procedures for distributing public keys.

*** PKCS : developed by RSA and used with PKI.

Answer 2

Digital Signatures

Question 3

enables authentication of parties involved in secure transition, in public certificate is public key, private certificate is only with the owner. Having certificate with public key allows to verify the hash w/owners private key. If public key is signed with owners private key and digital certificate is appended to message then you can more assure valid message.

Answer 3

Certificate Management

Question 4

• certificate issuers name
• valid from date / to date
• owner of certificate (subject)
• subjects public key
• time stamp
• certificate issuers digital signature

Answer 4

Typical Certificate Contains :

Question 5

organization for issuing, storing, revoking and distributing certificates, authenticates the certificates it issues by signing them w/their private key.

Answer 5

CA

Question 6

middleman between subscribers and CA, can distribute keys, accept registrations for CA and validate identities, RA doesn’t issue cert.’s on their own.

Answer 6

RA

Question 7

Alice wants to communicate with Bob, Bob registers to RA and wants cert. and private/public key pair, then request goes to CA, and then private/public keypair is sent back to Bob, cert. is stored in key store, if its a private CA its stored in the gallery (Active Directory etc), when Alice wants to communicate with Bob she reaches out to directory (key store) and says to Bob I want to communicate with you where is your cert. and public key she pulls down his cert with his public key. In his cert. is his public key, message digest encrypted with his private key, his digital cert.(digital cert.’s are signed with private keys), she can verify his cert. with her own message digest and compares both. Then using symmetric cryptography creates a session key to communicate with Bob. She encrypts message with session key, then she will encrypt that session key w/Bob’s public key, then sends it to Bob, Bob will decrypt packet with his private key, he’ll pull out session key that Alice created and decrypt message.

Answer 7

RA/CA and key exchange

Question 8

dictates circumstances in which cert. can be used, protects CA from claims of loss if cert. is misused, should identify users community, names of CA/RA, and object identifier.

Answer 8

Certificate Policy

Question 9

only for revoked cert.’s not expired cert.’s. Revoked due to compromise illegal activity etc, not revoked due to normal expiration.

Answer 9

CRL

Question 10

shouldnt be online, bring it online to do some work, but then take it back offline.

Answer 10

Root CA