Cyberstudy
PDF p.57 In progress

Certificate Authorities

Open PDF at p.57 21 flashcards

Summary

PDF p.57

Public key infrastructure (PKI) ensures that the owners of public keys are who they claim to be by using digital certificates validated by certificate authorities (CAs). CAs can be private (within an organization) or third-party (for public or business-to-business communications). Third-party CAs, such as Comodo, DigiCert, and Let's Encrypt, provide certificate services, validate identities, establish trust, manage certificate repositories, and handle key and certificate lifecycle management.

In plain words

Supplementary — not from your PDF

A public key alone doesn't prove who owns it. Certificate authorities (CAs) check identities and sign certificates that bind a public key to a name. That system is called PKI.

Detailed explanation

PDF p.57
  • Public Key Cryptography
    • Confidential Messages: Use public key to encrypt; only private key can decrypt.
    • Authentication: Sign message hash with private key; verify with public key.
  • Problem with Public Key Cryptography
    • Identity Verification: No inherent mechanism to establish the owner's identity.
    • E-commerce Concern: Ensuring the authenticity of websites and services distributing public keys.
  • Public Key Infrastructure (PKI)
    • Purpose: Proves the identity of public key owners.
    • Digital Certificates: Issued to validate public keys, guaranteed by CAs.
  • Types of Certificate Authorities
    • Private CA: Used within an organization; trusted internally.
    • Third-Party CA: Used for public/business communications; establishes trust between servers and clients.
  • Functions of Third-Party Public CAs
    • Certificate Services: Provide various certificate-related services.
    • Identity Validation: Ensure the validity of certificates and the identity of applicants.
    • Trust Establishment: Gain trust from users, governments, regulatory authorities, and enterprises.
    • Repository Management: Manage servers that store and administer certificates.
    • Lifecycle Management: Handle key and certificate lifecycle, including revocation of invalid certificates.

Important terms

taken from the text above
Confidential Messages
Use public key to encrypt; only private key can decrypt.
Authentication
Sign message hash with private key; verify with public key.
Identity Verification
No inherent mechanism to establish the owner's identity.
E-commerce Concern
Ensuring the authenticity of websites and services distributing public keys.
Digital Certificates
Issued to validate public keys, guaranteed by CAs.
Private CA
Used within an organization; trusted internally.
Third-Party CA
Used for public/business communications; establishes trust between servers and clients.
Certificate Services
Provide various certificate-related services.
Identity Validation
Ensure the validity of certificates and the identity of applicants.
Trust Establishment
Gain trust from users, governments, regulatory authorities, and enterprises.
Repository Management
Manage servers that store and administer certificates.
Lifecycle Management
Handle key and certificate lifecycle, including revocation of invalid certificates.
PKI Public key infrastructure CA Certificate Authority

Examples & real-world scenarios

Supplementary — not from your PDF
  • A public CA issuing a certificate for a bank's website.
  • A company's private CA issuing certificates for internal servers.
  • CAs revoking certificates that shouldn't be trusted any more.

Scenario

An internal wiki uses a certificate from the company's private CA. Company laptops trust it because IT installed the private root, but visitors' personal phones show a warning, as expected.

Common mistakes

Supplementary — not from your PDF
  • Thinking a private CA's certificates are trusted by the public. They're trusted only where the private root is installed.
  • Forgetting that the CA's job is identity validation, not encrypting your traffic.

Practical skills

Supplementary — not from your PDF
  • Choose a private or public CA for a given use.

What I should remember

Key Points PDF p.57
  • Public Key Cryptography
    • Confidential Messages: Encrypt with public key, decrypt with private key.
    • Authentication: Sign with private key, verify with public key.
  • Identity Verification Issue
    • No Built-in Mechanism: Public key cryptography lacks identity verification.
    • E-commerce Risk: Authenticity of websites and services.
  • Public Key Infrastructure (PKI)
    • Identity Proof: Uses digital certificates.
    • Certificate Authority (CA): Validates certificates.
  • Types of CAs
    • Private CA: Internal use.
    • Third-Party CA: Public/business use.
  • Third-Party CA Functions
    • Certificate Services: Various services for users.
    • Identity Validation: Ensure certificate and applicant validity.
    • Trust Establishment: Trusted by users and authorities.
    • Repository Management: Administer certificate storage.
    • Lifecycle Management: Manage keys and certificates, including revocation.