Public Key Infrastructure Flashcards
Define the PKI…
The PKI is an infrastructure that binds public keys to principals through certificates signed by certification authorities and registered by registered authorities. In essence, it enables public key authentication.
Can CA’s in the PKI be structured in a hierarchical manner? If so, what is the root of the hierarchy?
Yes they can, this means CA’s can be authenticated by other CA’s and only leaf CA’s can authenticate clients.
The root of the hierarchical structure is a root CA.
Define a certificate…
A token that binds a public key to an entity.
How is a certificate created and given?
Client brings in physical unsigned certificate to the CA. CA runs USC through a hash function, then encrypts the digest with their private key to create a signature. This signature is then appended to the USC to create a signed certificate. The client now has a signed certificate which proves their public key belongs to them.
How does someone verify a public key certificate?
The user can run the signed certificate (without the signature) through the hash function used. The user can then run the digest and the CA’s public key into the signature verification algorithm.
What are the 4 PKI components? Define each…
Certification Authorities - Creates certificates that binds keys to identities. Publishes certificates to the directory. Maintains CRL.
Registered Authorities - Registers users and issues certificates; Ensures proper user identification.
Clients - Anyone entity who is intending to use the PKI in some way.
Directory - Lists all certificates and makes them available.
What are 6 key components of an X.509 certificate?
Serial Number
Public Key Algorithm
Issuer Name
Period of Validity
Subject Name
Signature
What is the Certification Revocation List?
A list of all certificates tat have been revoked by the CA before the period of validity has come to an end.
What are the components of each record on the CRL?
Name
Date of revocation
Date of next scheduled certificate
Signature of CA
What is X.509
The most recent standard of PKI.
What 3 cryptographic components is X.509 based on?
Cryptography, hashes, digital signatures.
How is the signature appended to the certificate created?
It is a hash value of the unsigned certificate which is then run through a signature algorithm with the CA’s private key.
