Embed Size (px)
DESCRIPTION
ITU Workshop on “Caller ID Spoofing” (Geneva, Switzerland, 2 June 2014). Introduction to public-key infrastructure (PKI). Erik Andersen, Q.11 Rapporteur, ITU-T Study Group 17 [email protected]. PKI and PMI. Public-key certificates: The basis for public-key infrastructure ( PKI ) - PowerPoint PPT Presentation
Citation preview
Geneva, Switzerland, 2 June 2014
Introduction topublic-key infrastructure (PKI)
Erik Andersen,Q.11 Rapporteur,
ITU-T Study Group [email protected]
ITU Workshop on “Caller ID Spoofing”(Geneva, Switzerland, 2 June 2014)
Geneva, Switzerland, 2 June 2014 2
PKI and PMI
Public-key certificates: The basis for public-key infrastructure (PKI)
Attribute certificates: The basis for privilege management infrastructure (PMI)
Rec. ITU-T X.509 | ISO/IEC 9594-8 base specification for both types of infrastructure
3
Facts about X.509
Geneva, Switzerland, 2 June 2014
Part of the X.500 Series of RecommendationsAlso issued as ISO/IEC 9594-8Issued in seven editionsFirst edition in 1988Eight edition on its wayNumber one in downloadsDefines:
Public key/private key principlesPublic-key certificatesPublic-key infrastructure (PKI)Attribute certificatesPrivilege management infrastructure (PMI)
PKI
4
Asymmetric cryptography
Geneva, Switzerland, 2 June 2014
A B
Action usingprivate key
Resolving usingpublic key
Action usingpublic key
Resolving usingprivate key
Private key Public key
Asymmetric cryptography is basic technology behind PKI and PMI
5
PKI entities
Geneva, Switzerland, 2 June 2014
CRLIssuer
End entity
RegistrationAuthority
CA
Certificate&
CRLrepository(e.g., an LDAP or X.500
directory)
CA
6
Certifying the identity usingpublic-key certificates
Geneva, Switzerland, 2 June 2014
Certification Authority
OK
7
Public-key certificate
Geneva, Switzerland, 2 June 2014
Subject
Serial number
Public key info
Version
Algorithm
ValidityIssuer
Issuer unique idSubject unique id
Extensions
Digital signature of issuer
Version 2 (do not use!)
Version 3 - Important
Extensions
The extension concept allows adding additional information to a public-key certificate.Organizations may define own extensions.If the information changes, the public-key certificate has to be renewed.
Geneva, Switzerland, 2 June 2014 9
Certification authority (CA)
NOT: Certificate authorityVerify the identity of the subject Verify the position of the key-pairVerify the other information as requiredIssues and sign the public-key certificate Maintain revocation statusPublishes revocation status
10
Checking the credentials
Geneva, Switzerland, 2 June 2014
A passport is a type of certificate binding a picture to a subject IDHas to be issued by a trustworthy authorityA passport may be falseIt is checked by the validator, also called the relying party
SubjectRelying party
11
Trust
Geneva, Switzerland, 2 June 2014
Would you buy a certificate of this man?
Would you trust a certificate issued by this man?
Certificates
Hierarchical Structure
Trust anchor
CA CA
EE EE EE EE EE EE EE EE
CA CACACA
CA = Certification authorityEE = End entity
13
Trust anchor
Trusted by a relying partyTrust anchor information:
Configured into relying party
Public-key certificate
or similar information
Geneva, Switzerland, 2 June 2014
Certificate Revocation List (CRLs)
Certificate Serial NumberRevocation Date
VersionAlgorithm
Time for this updateIssuer
Extensions
Digital signature of issuer
Time for next update
CRL Extensions
Certificate Serial NumberRevocation Date
Extensions
Revoked Certificate
Revoked Certificate
15
Online Certificate Status Protocol (OCSP)
Geneva, Switzerland, 2 June 2014
OCSP requestOCSP
response
OCSP responder
OCSP client
Validation procedure
TrustAncho
r
User system A
(end entity)
CA
CA
User system B(Relying Party)
Storing ofTrust AnchorInformation
Check ofrevocation
Signeddata
17
Where to go
Geneva, Switzerland, 2 June 2014
The central source for information on theX.500 Directory Standard including X.509.
www.x500standard.com
