CYS401 · Annotated SlidesChapter 6.2 — Public Key Infrastructure
Chapter 6.2 · Annotated slides

Public Key Infrastructure

Why PKI is needed (can you trust a public key?), digital certificates (X.509), the certificate life cycle and revocation lists, the PKI players (CA, RA, repositories), certificate policy, and certificates in SSL/TLS. Final 221 B asked where to find revoked certificates and which keys sign and validate an X.509 certificate.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up

Public Key Infrastructure

CYS401 · Lecture 6.2
1

Agenda

  • PKI Overview
  • Digital Signatures
    • What is it?
    • How does it work?
  • Digital Certificates
  • Public Key Infrastructure
    • PKI Components
    • Policies
2
Exam weight Low
  1. PKI overview, digital signatures, certificates.
Slide 4: The Critical Questions
Exam weight Medium
  1. The critical question: how do I KNOW a public key really belongs to that person? → certificates from a trusted CA.

Receiver Public Key

Receiver Private Key

Sender Private Key

Sender Public Key

5
Exam weight Low
  1. Receiver’s public and private key in use.
Slide 6: Digital Certificates
Exam weight Low
  1. A digital certificate binds an identity to a public key, signed by a CA.
Slide 7: Slide 7
Exam weight Low
  1. Certificate contents.
★ Past exam
Slide 8: Digital Certificates
Exam weight High
  1. X.509 certificate: owner, issuer (CA), validity, public key, signed by the CA. The CA signs with ITS private key; anyone validates with the CA’s public key.

Asked in a real exam

★ Final 221 · B · written · keys for issuing and validating an X.509 certificate
🎯 How this can come up · 1 question
Written

Which keys are used to issue and validate an X.509 certificate, and who issues it? (Final 221 B)

Slide 9: Three states for cert. • In use
Exam weight Low
  1. Life cycle states: in use (valid), expired, revoked (e.g., the private key was compromised).
★ Past exam

Certificate Revocation Lists

  • CA periodically publishes a data structure called a certificate revocation list (CRL).
  • Described in X.509 standard.
  • Each revoked certificate is identified in a CRL by its serial number.
  • CRL might be distributed by posting at known Web URL or from CA’s own X.500 directory entry.
10
Exam weight High
  1. CRL (Certificate Revocation List): published periodically by the CA (X.509). Also OCSP for online checks.

Asked in a real exam

★ Final 221 · B · written · where to search for a revoked certificate★ Major 181 · MCQ · why a CA revokes a certificate★ Final 221 · B · MCQ · reason not appropriate for revocation
🎯 How this can come up · 2 questions
Written

Where can you search for a revoked certificate? (Final 221 B)

MCQ

A CA revokes a user’s certificate when:

Slide 11: DC in reality
Exam weight Low
  1. A real certificate viewed in a browser.
Slide 12: PKI Players
Exam weight High
  1. PKI players: RA (verifies identity, approves), CA (issues certificates and CRLs), repositories, users.
🎯 How this can come up · 1 question
MCQ

Which PKI component verifies a user’s identity before a certificate is issued?

Slide 13: Certification Authority (CA)
Exam weight Low
  1. CA: the trusted third party that issues, signs and revokes certificates.

Registration Authority (RA)

  • Enrolling, de-enrolling, and approving or rejecting requested changes to the certificate attributes of subscribers.
  • Validating certificate applications.
  • Authorizing requests for key-pair or certificate generation and requests for the recovery of backed-up keys.
  • Accepting and authorizing requests for certificate revocation or suspension.
  • Physically distributing personal tokens to and recovering obsolete tokens from people authorized to hold and use them.
14
Exam weight Low
  1. RA: enrols and de-enrols subscribers, validates applications.

Certificate Policy (CP) is ...

  • the basis for trust between unrelated entities
  • not a formal “contract” (but implied)
  • a framework that both informs and constrains a PKI implementation
  • a statement of what a certificate means
  • a set of rules for certificate holders
  • a way of giving advice to Relying Parties
15
Exam weight Low
  1. Certificate Policy: the basis for trust between unrelated parties.
Slide 16: Public Key Security
Exam weight Low
  1. Public-key security relies on the private key staying private.
Slide 17: Certificate and SSL
Exam weight Low
  1. Certificates in SSL/TLS: the server sends its certificate; the browser checks it against trusted CAs.

The

End...

19
Exam weight Low
  1. End.