Module 17 Flashcards
are a mathematical technique used to provide authenticity, integrity, and nonrepudiation.
Digital signatures
The following are characteristics of digital signatures:
- Authentic
- Unalterable
- Not reusable
- Non-repudiated
- The signature cannot be forged and provides proof that the signer, and no one else, signed the document.
- Authentic
- After a document is signed, it cannot be altered.
- Unalterable
- The document signature cannot be transferred to another document.
- Not reusable
- The signed document is considered to be the same as a physical document.
- Non-repudiated
Digital signatures are commonly used in the following two situations:
code signing and
digital certificates.
There are three Digital Signature Standard (DSS) algorithms that are used for generating and
verifying digital signatures:
- Digital Signature Algorithm (DSA)
- Rivest-Shamir Adelman Algorithm (RSA)
- Elliptic Curve Digital Signature Algorithm (ECDSA)
- DSA is the original standard for generating public and private key pairs, and for generating and verifying digital signatures.
- Digital Signature Algorithm (DSA)
- RSA is an asymmetric algorithm that is commonly used for generating and verifying digital signatures.
- Rivest-Shamir Adelman Algorithm (RSA)
- ECDSA is a newer variant of DSA and
provides digital signature authentication and non-repudiation with the added benefits of computational efficiency, small signature sizes, and minimal bandwidth.
- Elliptic Curve Digital Signature Algorithm (ECDSA)
Digitally signing code provides several assurances about the code.
- The code is authentic and is actually sourced by the publisher.
- The code has not been modified since it left the software publisher.
- The publisher undeniably published the code. This provides nonrepudiation of the
act of publishing.
A ____ is used to authenticate and verify
that a user who is sending a message is who they claim to be. ___ can also be used to provide confidentiality for the receiver with the means to encrypt a reply.
digital certificate
When establishing an asymmetric connection between two hosts, the hosts will exchange their
public key information.
True
An __is a digital certificate that confirms the identity of a website domain.
SSL certificate
Some examples of Certificate Authorities (CAs) are
IdenTrust, DigiCert, Sectigo, GlobalSign, and
GoDaddy.
These CAs charge for their services.
Let’s Encrypt is a non-profit CA that offers
certificates free of charge.
is needed to support large-scale distribution and identification of public encryption keys.
Public key infrastructure (PKI)
CAs, especially those that are outsourced, issue certificates based on classes which determine
how trusted a certificate is.
The class number is determined by how rigorous
the procedure was that verified the identity of the holder when the certificate was issued.
The higher the class number, the more trusted the certificate.
0 Used for testing in situations in which no checks have been performed.
1 Used by individuals who require verification of email.
2 Used by organizations for which proof of identity is required.
3 Used for servers and software signing. Independent verification and checking of identity and authority is done by the certificate authority.
4 Used for online business transactions between companies.
5 Used for private organizations or government security.
PKI Trust System
PKIs can form different topologies of trust.
The simplest is the single-root PKI
topology.
On larger networks, PKI CAs may be linked using two basic architectures:
- Cross-certified CA topologies
- Hierarchical CA topologies
Interoperability between a PKI and its
supporting services, such as Lightweight
Directory Access Protocol (LDAP) and
X.500 directories, is a concern because
many CA vendors have proposed and
implemented proprietary solutions instead
of waiting for standards to develop.
To address this interoperability concern,
the IETF published the ____
Internet X.509
Public Key Infrastructure Certificate Policy and Certification Practices Framework (RFC 2527).
The ___standard defines the format of a digital certificate.
X.509 version 3 (X.509 v3)
Certificate Enrollment, Authentication, and Revocation
- All systems that leverage the PKI must have the CA’s public key, which is called the self-signed
certificate. The CA public key verifies all the certificates issued by the CA and is vital for the proper operation of the PKI. - For many systems such as web browsers, the distribution of CA certificates is handled automatically.
- The certificate enrollment process is used by a host system to enroll with a PKI. To do so, CA
certificates are retrieved in-band over a network, and the authentication is done out-of-band (OOB)
using the telephone. - Authentication no longer requires the presence of the CA server, and each user exchanges their
certificates containing public keys. - Certificates must sometimes be revoked. The two of the most common methods of revocation are
Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP).
Where can PKI be used by an enterprise? The following provides a short list of common
uses of PKIs:
- SSL/TLS certificate-based peer authentication
- Secure network traffic using IPsec VPNs
- HTTPS Web traffic
- Control access to the network using 802.1x authentication
- Secure email using the S/MIME protocol
- Secure instant messaging
- Approve and authorize applications with Code Signing
- Protect user data with the Encryption File System (EFS)
- Implement two-factor authentication with smart cards
- Securing USB storage devices
PKI-related issues that are
associated with security warnings include:
- Validity date range - The X.509v3 certificates specify “not before” and “not after” dates. If
the current date is outside the range, the web browser displays a message. Expired
certificates may simply be the result of administrator oversight, but they may also reflect
more serious conditions. - Signature validation error - If a browser cannot validate the signature on the certificate,
there is no assurance that the public key in the certificate is authentic. Signature validation
will fail if the root certificate of the CA hierarchy is not available in the browser’s certificate
store.
