7. Digital Signature Certificate Technology
• What is PKI?
The PKI is a framework of policies, services, and encryption software that provides the assurances, users need before they can confidently transmit sensitive information over the Internet and other networks. At the heart of a PKI is a "Certifying Authority" which issues to each individual a Digital Certificate linking that particular person to a known public key.
• What is cryptography?
Cryptography is the science of using mathematics to encrypt and decrypt data. Cryptography enables you to store sensitive information or transmit it across insecure networks (like the Internet) so that it cannot be read by anyone except the intended recipient. In short, cryptography is science of securing data
• What is secret key cryptography?
Secret-key cryptography is sometimes referred to as symmetric cryptography. It is the more traditional form of cryptography, in which a single key can be used to encrypt and decrypt a message. Secret-key cryptography not only deals with encryption, but it also deals with authentication.
• What is Public Key Cryptography?
Public Key Cryptography is a method for securely exchanging messages, based on assigning two complimentary keys (one public, one private) to the individuals involved in a transaction. Public Key Cryptography is based on the science of encryption, the mathematical scrambling and unscrambling of messages.
• What is authentication?
Authentication is the process of verifying a claimed identity. This includes:
Establishing that a given identity actually exists;
Establishing that a person or organization is the true holder of that identity;
Enabling identity holders to identify themselves for the purposes of carrying out a transaction via an electronic medium.
• What is encryption?
Encryption is the process of using a mathematical formula and an encryption key to scramble information so that is unintelligible to unauthorized persons. Since electronic information is in the form of a series of ones and zeroes, an encryption process can transform a particular electronic message into another sequence of ones and zeros that is uniquely related to the original message.
• What is decryption?
Decryption is the process of converting the scrambled information back to its original, plain text form using the same mathematical formula and a decryption key related to the encryption key so an authorized person can understand it.
• What is non-repudiation?
Non-repudiation provides proof of the origin or delivery of data in order to protect the sender against a false denial by the recipient that the data has been received or to protect the recipient against false denial by the sender that the data has been sent.
• What is Private Key?
"Private Key" means one of the key of a key pair used to create a Digital Signature.
• What is Smart Card?
A plastic card like credit card with a built-in microprocessor and memory used for identification or financial transactions. When inserted into a reader, it transfers data to and from a central computer. It is more secure than a magnetic stripe card and can be programmed to self-destruct if the wrong password is entered too many times.
• What is an e-token?
An e-token is a powerful and secure hardware device that enhances he security of data on public and private networks. The size of a normal house key, e-token can be used to generate and provide secure storage for passwords and Digital certificates, for secure authentication, digital signing and encryption. E-tokens are based on smart card technology but require no special readers.
• What is key agreement protocol?
A key agreement protocol, also called a key exchange protocol, is a series of steps used when two or more parties need to agree upon a key to use for a secret-key crypto system. These protocols allow people to share keys freely and securely over any insecure medium, without the need for a previously established shared secret.
• What is a digital envelope?
The digital envelope consists of a message encrypted using secret-key cryptography and an encrypted secret key.
• What is a hash algorithm?
An algorithm that transforms a string of characters into a usually shorter value of a fixed length or a key that represents the original value. This is called the hash value. Hash functions are employed in symmetric and asymmetric encryption systems and are used to calculate a fingerprint/imprint of a message or document. When hashing a message, the message is converted into a short bit string - a hash value - and it impossible to re-establish the original message from the hash value. A hash value is unique in the sense that two messages cannot result in the same bit string, and any attempt to make changes to the message will negate the value and thus the signature.
• What is digital time stamping?
A digital time-stamping service issues time-stamps, which associate a date and time with a digital document in a cryptographically strong way. The digital time-stamp can be used at a later date to prove that an electronic document existed at the time stated on its time-stamp. For example, a physicist who has a brilliant idea can write about it with a word processor and have the document time-stamped. The time-stamp and document together can later prove that the scientist deserves the Nobel Prize, even though an archrival may have been the first to publish.
• What are Public Key Cryptography Standards?
Public Key Cryptography Standards are a set of standard protocols for the development of a public key infrastructure (PKI). These standards include RSA encryption, password-based encryption, extended certificate syntax, and cryptographic message syntax for the S/MIME secure e-mail standard. Developed in 1991 by RSA Laboratories with representatives from various computer vendors, PKCS is today widely deployed in public key cryptography systems.
PKCS #1: RSA Cryptography Standard describes a method for encrypting data by using the RSA public key crypto system. Used in the construction of digital signatures and digital envelopes.
PKCS #2: Has been incorporated into PKCS #1.
PKCS #3: Diffie-Hellman Key Agreement Standard describes a method for implementing the Diffie-Hellman key agreement. PKCS#3 is used in protocols for establishing secure communications.
PKCS #4: Has been incorporated into PKCS #1.
PKCS #5: Password-based Cryptography Standard Password-based security standard.
PKCS #6: Extended Certificate Syntax Standard describes a syntax for extended certificates, consisting of a certificate and a set of attributes, collectively signed by the issuer of the certificate. This extends the certification to allow for verification of other information concerning the entity.
PKCS #7: Cryptographic Message Syntax Standard specifies a general format for cryptographic messages.
PKCS #8: Private Key Information Syntax Standard describes syntax for private key information. Private Key information includes a private key for a public key algorithm and a set of attributes. The standard also describes syntax for encrypted private keys.
PKCS #9: Selected Attribute Types defines selected attribute types for use in some of the PKCS standards.
PKCS #10: Certification Request Syntax Standard specifies a standard syntax for certificate requests.
PKCS #11: Cryptographic Token Interface Standard defines a technology-independent programming interface for cryptographic devices such as smart cards.
PKCS #12: Personal Information Exchange Syntax Standard specifies a portable format for storing or transporting a user's private keys, certificates, miscellaneous secrets etc.
PKCS #13: Elliptic Curve Cryptography Standard under development. The standard will include many aspects of elliptic key cryptography, including parameter and key generation/validation, digital signatures, public key encryption, key agreement, and ASN.1 syntax.
PKCS #14: Pseudorandom Number Generation Standard under development. The standard will address many aspects of pseudorandom number generation.
PKCS #15: Cryptographic Token Information Format Standard for cryptographic tokens used for identification purposes.
• What is Cryptographic Service Provider?
A Cryptographic service provider is responsible for creating keys, destroying them, and using them to perform a variety of cryptographic operations. Each cryptographic service provider provide a different implementation of the crypto API, some provide stronger cryptographic algorithms, while others contain hardware components, such as smart cards.
• What is a Distinguished Name (DNs)?
A unique identifier of a person or thing having the structure required by the relevant certificate profile. A distinguished name is assigned to each key holder, organization or other entity.
• What is SSL (secure socket layer)?
Secured Sockets Layer is a protocol that transmits your communications over the Internet in an encrypted form. It is designed by Netscape Communications to enable encrypted, authenticated communications across the Internet. SSL ensures that the information is sent, unchanged, only to the server you intended to send it to. Online shopping sites frequently use SSL technology to safeguard your credit card information.
When SSL is employed to secure your transaction, the information contained in your transaction is secretly encoded as it is sent between your computer and the computer (web server) you have linked to. Note, for an SSL transaction to work, your browser must be SSL compatible, and the web server you have linked to must be able to perform the necessary "key exchange" with your SSL compatible browser.
• What is MIME?
MIME (Multipurpose Internet Mail Extensions) is a set of specifications for the interchange of text in languages with different character sets. MIME is also used to attach multimedia and rich text elements to e-mail that may be transmitted among different computer systems using Internet mail standards. The specifications define Content-Types and other conventions for the formatting of e-mail messages. S/MIME is a later standard that adds security to e-mail communication by allowing signing and encryption of messages.
• What is S/MIME?
A standard that extends the MIME (Multipurpose Internet Mail Extensions) specifications to support the signing and encryption of e-mail transmitted across the Internet.
• What do X.509 and X.500 mean?
X.509: - A widely used standard for defining Digital Certificates. X.509 is actually an ITU Recommendation, which means that it has not yet been officially defined or approved for standardized usage. As a result, companies have implemented the standard in different ways. For example, both Netscape and Microsoft use X.509 certificates to implement SSL in their Web servers and browsers. But an X.509 Certificate generated by Netscape may not be readable by Microsoft products, and vice versa.
X.500: - An ISO and ITU standard that define how global directories should be structured. X.500 directories are hierarchical with different levels for each category of information, such as country, state, and city. X.500 supports X.400 systems.
• What is Certificate Validation Mechanism?
A certificate validation mechanism is a mechanism, which is used when a document or transaction is signed using a Digital Certificate, and which serves as a means of identifying the person who signed since a certificate vouches for the owner's identity or association with a particular organization. Hence a certificate validation mechanism is important to implement to ensure that it has not been revoked or has not expired.
• What is Certificate Validation?
Validation refers to determining the status of a certificate - whether valid, expired or revoked. All Certificates have a fixed life (say one year), but there are various reasons for which a certificate may be invalidated before its due expiry.
• What is OCSP Validation?
OCSP refers to certificate validation that occurs through the Online Certificate Status Protocol mechanism, this type of validation occurs only when the signer certificate is stamped with an AIA (Authority Information Access) extension.
OCSP can be either a replacement or a supplement to checking the validity of a certificate against a Certificate Revocation List (CRL). Using OCSP, when a user attempts to access a server, OCSP sends a request for certificate status information. The server sends back a response of "current", "expired," or "unknown."
• What is CAM?
The Certificate Arbitrator Module (CAM) was created to provide validation services across different vendors of the ACES program. It is an application level router that efficiently and consistently routes certificates from relying party programs to the issuing certificate authorities for validation. By interfacing directly with the CAM, a relying party application can interact seamlessly with multiple CAs.