Key Distribution

Question 1

what are the advantages of asymmetric key encryption

Answer 1

• Better Scalability than Symmetric Key Cryptosystems
• Can provide confidentiality, authentication and nonrepudiation
• Key Distribution Management
• Uses one Key to encrypt, the other to decrypt

Question 2

how are certificates, and their certificate

chains, verified and disseminated?

Answer 2

(1) Trusted Third Party (TTP)
(2) Certificate Authority (CA)
(3) Simple Public Key Infrastructure (SPKI)

Question 3

what are functions performed by CA

Answer 3

• Trusted, 3rd party organization
• CA (Certificate Authority) guarantees that the
individual granted a certificate is who he/she
claims to be
• CA usually has arrangement with financial
institution to confirm identity
• Critical to data security and electronic commerce
• Well known organisation establish themselves to
act as certificate authorities. Verisign, CREN,
etc.
• One can then obtain X.509 public key
certificates from them by submitting satisfactory
evidence of their identity.

Question 4

what is .X509?

Answer 4

it is a Most widely used standard for certificates.

Question 5

what is PKI?

Answer 5

• PKI is an ISO authentication “framework” that uses public key
cryptography and X.509 standard protocols.
• The framework establishes a generalized architecture for
exchanging secure communication across networks. (Internet,
internal / external).

Question 6

what is a Certificate Revocation List

Answer 6

•Revocation is managed with a Certificate Revocation List
(CRL), a form of anti-certificate which cancels a certificate
• Equivalent to 1970s-era credit card blacklist booklets
• Relying parties are expected to check CRLs before using
a certificate

Question 7

what are the problems with CRL distribution

Answer 7

CRLs have a fixed validity period
– Valid from issue date to expiry date
• At expiry date, all relying parties connect to the CA to fetch
the new CRL
– Massive peak loads when a CRL expires (DDOS attack)

Question 8

advantages of OCSP

Answer 8

Lightweight pseudo-CRL avoids CRL size problems
– Reply is created on the spot in response to the request
– Ephemeral pseudo-CRL avoids CRL validity period problems

Question 9

problems with OCSP

Answer 9

Returned status values are non-orthogonal
– Status = “good”, “revoked”, or “unknown”
– “Not revoked” doesn’t necessarily mean “good”
– “Unknown” could be anything from “Certificate was never
issued” to “It was issued but I can’t find a CRL for it”