Private Keys Flashcards
1
Q
Personal Security Environment
A
- Stores: Private keys, certificates, other data
- Provides: Compatibility, Portability, Availability, Access protection
2
Q
Secure storage of private keys in software
A
- Standardized (e.g. PKCS#12)
- OS/language specific (e.g. Java Keystore)
- Application specific (e.g. Firefox)
3
Q
Secure storage of private keys in hardware
A
- Hardware security module
- USB-Token
- Smartcard
4
Q
PKCS#12 Structure
A
- Authenticated Safe
- Content Info: Plain data, encrypted data, enveloped data
5
Q
PKCS#12 Exchange Modes: Content Privacy
A
- Data Mode (plain): No encryption
- Password Privacy Mode (encrypted): Encryption with a symmetric key which is derived from a password
- Public Key Privacy Mode (enveloped): Encryption with a symmetric key which is encrypted with the public key of the receiver
6
Q
PKCS#12 Exchange Modes: Content Integrity & authentication
A
- Password Integrity Mode: A MAC is calculated with a symmetric key which is encrypted with the public key of the receiver
- Public Key Integrity Mode: Signed with the private key of the issuer
7
Q
Hardware Security Module
A
- Secure key storage and use
- (Pseudo)random number generation
- Key (pair) generation
- Key archiving
- Encryption / decryption
- Generating / verifying signatures
- Hashing
- Acceleration for cryptographic schemes
8
Q
HSM Protection
A
- Protect the keys against: mechanical attacks, temperature attacks, manipulation of the voltage, chemical attacks
- Keys are destroyed in case of danger
9
Q
PKCS#11
A
- “Cryptographic Token Interface”
- Support functions like: Change PIN, Sign, Decrypt, Write certificate
- But: Some functions are not supported, different libs are needed for supporting different cards and readers
10
Q
Smartcards
A
- Secure key storage and use
- Key pair generation (not all)
- (Pseudo)random number generation (not all)
- Calculation of digital signatures
- Decryption
- Access via: PKCS#11, CT-API, PC/SC
11
Q
PKCS#15
A
- Specifies the structure of the file system on the chip card
- Pointers to cryptographic objects (ODF)
-> Private key, public key, certificate
12
Q
Private key lifecycle: Generate
A
- Appropriate algorithms and parameters
- Secure (P)RNG (Random Number Generator)
- Shielding against eavesdropping
13
Q
Private key lifecycle: Copy
A
- Usually to be avoided but may be reasonable
- Easy for authorized users
- Impossible for unauthorized users
14
Q
Private key lifecycle: Store/deposit
A
- Persistent storage
- Deletion from the generator
- Appropriate access protection
- Only deposit special types of keys
15
Q
Private key lifecycle: Restore/recover
A
- Correct reestablishment
- Easy for authorized users
- Impossible for unauthorized users
