Table of Contents
Foreword.
Preface.
About the Authors.
I. CONCEPTS.
1. Introduction.
2. Public-Key Cryptography.
Symmetric versus Asymmetric Ciphers.Secret Key.New Directions:
Public Key.Public/Private-Key Pair.Services of Public-Key
Cryptography.Security between Strangers. Encryption. Digital
Signature. Data Integrity. Key Establishment. Other Services.
Algorithms.RSA. DSA. DH. ECDSA and ECDH. SHA-1. Ongoing Work.
Summary.
3. The Concept of an Infrastructure.
Pervasive Substrate.Application Enabler.Secure Sign-On. End-User
Transparency. Comprehensive Security. Business Drivers.Public-Key
Infrastructure Defined. Certification Authority. Certificate
Repository. Certificate Revocation. Key Backup and Recovery.
Automatic Key Update. Key History. Cross-Certification. Support for
Non-repudiation. Time Stamping. Client Software. Summary.
4. Core
PKI Services: Authentication, Integrity, and
Confidentiality.
Definitions.Authentication. Integrity. Confidentiality.
Mechanisms.Authentication. Integrity. Confidentiality. Operational
Considerations.Performance. Online versus Offline Operation.
Commonality of Underlying Algorithms. Entity Naming. Summary.
5.
PKI-Enabled Services.
Secure Communication.Secure Time
Stamping.Notarization.Non-repudiation.Connection with Other
Services. Need for Secure Data Archive. Complexity of This Service.
The Human Factor. Privilege Management.Authentication and
Authorization. Authorization Authorities. Delegation. Connection
with the PKI. Privacy.Mechanisms Required to Create PKI-Enabled
Services.Digital Signatures, Hashes, MACs, and Ciphers. Trusted
Time Sources. Privilege Policy Creation Mechanism. Privilege Policy
Processing Engines. Privilege Management Infrastructure Mechanisms.
Privacy Architecture. Operational Considerations.Trusted Time
Delivery Mechanism. Secure Protocols. Server Redundancy. Physically
Secure Archive Facilities. Privacy Certificates and Identity
Mapping. Real Life. Comprehensive PKI and Current
Practice.Summary.
6. Certificates and Certification.
Certificates.Digital Certificate. Certificate Structure and
Semantics.Alternative Certificate Formats. Certificate Policies.
Object Identifiers. Policy Authorities. Certification
Authority.Registration Authority.Summary.
7. Key and Certificate
Management.
Key/Certificate Life-Cycle Management.Initialization Phase. Issued
Phase. Cancellation Phase. Summary.
8. Certificate
Revocation.
Periodic Publication Mechanisms.Certificate Revocation Lists
(CRLs). Complete CRLs. Certification Authority Revocation Lists
(CARLs). End-Entity Public-Key Certification Revocation Lists
(EPRLs). CRL Distribution Points. Redirect CRLs. Delta and Indirect
Delta CRLs. Indirect CRLs. Certificate Revocation Trees (CRTs).
Online Query Mechanisms. Online Certificate Status Protocol (OCSP).
Simple Certificate Validation Protocol (SCVP). Other Revocation
Options.Performance, Scalability, and Timeliness.Summary.
9.
Trust Models.
Strict Hierarchy of Certification Authorities.Loose Hierarchy of
Certification Authorities.Policy-Based Hierarchies.Distributed
Trust Architecture. Mesh Configuration. Hub-and-Spoke
Configuration. Four-Corner Trust Model.Web Model.User-Centric
Trust.Cross-Certification.Entity Naming.Certificate Path
Processing.Path Construction. Path Validation. Trust Anchor
Considerations. Summary.
10. Multiple Certificates per
Entity.
Multiple Key Pairs.Key Pair Uses.Relationship between Key Pairs and
Certificates. Real-World Difficulties.Independent Certificate
Management.Support for Non-repudiation.Summary.
11. PKI
Information Dissemination: Repositories and Other
Techniques.
Private Dissemination.Publication and Repositories.Locating
Repositories 162Tradeoffs. Interdomain Repository Issues and
Options.Direct Access. Border Repository. Shared Repository.
Interdomain Replication. In-band Protocol Exchange.Summary.
12.
PKI Operational Considerations.
Client-Side Software.Off-line Operations.Physical Security.Hardware
Components.User Key Compromise.Disaster Preparation and
Recovery.Relying Party Notification. Preparation. Recovery.
Additional Observations. Summary.
13. Electronic Signature
Legislation and Considerations.
Electronic Signature Legislation.E-Sign. Digital Signatures in
Context. EU Electronic Signature Directive. The Significance of
Electronic Signature Initiatives.Legal Considerations for PKIs. CA
Requirements. Roles and Responsibilities. Private Enterprise PKIs.
Other Contractual-Based Frameworks. Confidentiality.Summary.
14.
PKI in Practice.
What PKI Does.What PKI Does Not Do.The Value of PKI.When
Certificates and People Meet.An E-mail Scenario. A Web Scenario.
Summary.
15. The Future of PKI.
What Happened?How the World Is Changing.A Recognized Authoritative
Body. A Motivation. Users. Reasons for Cautious
Optimism.Summary.
16. Conclusions and Further Reading.
Conclusions.Suggestions for Further Reading.
II. STANDARDS.
17. Introduction.
18. Major Standards Activities.
X.509.PKIX.X.500.LDAP.ISO TC68.ANSI
X9F.S/MIME.IPsec.TLS.SPKI.OpenPGP.EDIFACT.IEEE.WAP.XML-Based
Activities.Other Activities.U.S. FPKI. MISPC. GOC PKI. SET. SEMPER.
ECOM. JCP. ICE-CAR. Summary.
19. Standardization Status and Road
Map.
Current Standardization Status.X.509. PKIX. X.500. LDAP. S/MIME.
IPsec. TLS. Toolkit Requirements (APIs and Mechanisms). Others.
Ongoing Standardization Work.Summary.
20. Standards: Necessary
but Not Sufficient.
The Role of Standards, Profiles, and Interoperability
Testing.Profiles and Interoperability Testing. Interoperability
Initiatives.Automotive Network eXchange. Bridge CA Demonstration.
Federal PKI. Minimum Interoperability Specification. National
Automated Clearing House Association. PKI X.509. Securities
Industry Root CA Proof of Concept. EEMA PKI Challenge.
Summary.
21. Conclusions and Further Reading.
Conclusions.Suggestions for Further Reading.Certificate/CRL Syntax
and Life-Cycle Management Protocols. Certificate/CRL Storage and
Retrieval. XML-Based Initiatives. Interoperability Initiatives.
Standards Bodies' Web Sites. Books.
III. DEPLOYMENT CONSIDERATIONS.
22. Introduction.
23. Benefits and Costs of a PKI.
Business Case Considerations.Cost Considerations.Deployment: Now or
Later?Summary.
24. Deployment Issues and Decisions.
Trust Models: Hierarchical versus Distributed.In-sourcing versus
Out-sourcing.Build versus Buy.Closed versus Open Environment.X.509
versus Alternative Certificate Formats.Targeted Applications versus
Comprehensive Solution.Standard versus Proprietary
Solutions.Interoperability Considerations.Certificate and CRL
Profiles. Multiple Industry-Accepted Standards. PKI-Enabled
Applications. Policy/Business Control Issues. On-line versus
Off-line Operations.Peripheral Support.Facility
Requirements.Personnel Requirements.Certificate
Revocation.End-Entity Roaming.Key Recovery.Repository
Issues.Disaster Planning and Recovery.Security Assurance.Mitigating
Risk.Summary.
25. Barriers to Deployment.
Repository Issues.Lack of Industry-Accepted Standard. Multivendor
Interoperability. Scalability and Performance. Knowledgeable
Personnel.PKI-Enabled Applications.Corporate-Level
Acceptance.Summary.
26. Typical Business Models.
Internal Communications Business Model.External Communications
Business Model.Business-to-Business Communication.
Business-to-Consumer Communication. Internal/External Business
Model Hybrids.Business Model Influences.Government-Sponsored
Initiatives.Interdomain Trust.Identrus. Bridge CA. VeriSign Trust
Network. GTE CyberTrust/Baltimore Technologies OmniRoot. Other
Trust Networks. Summary.
27. Conclusions and Further
Reading.
Conclusions.Suggestions for Further Reading.
References.
Index. 0672323915T10162002Promotional Information
PKI (public-key infrastructure) enables the secure exchange of
data over otherwise unsecured media, such as the Internet. PKI is
the underlying cryptographic security mechanism for digital
certificates and certificate directories, which are used to
authenticate a message sender. Because PKI is the standard for
authenticating commercial electronic transactions, Understanding
PKI, Second Edition provides network and security architects with
the tools they need to grasp each phase of the key/certificate life
cycle, including generation, publication, deployment, and
recovery.
About the Author
Carlisle Adams is recognized internationally for his many
contributions to the design, specification, and standardization of
public-key infrastructures. He is senior cryptographer and
principal of security at Entrust, Inc. He has been an active
participant in the IETF Public-Key Infrastructure X.509 (PKIX) and
Common Authentication Technology (CAT) working groups.
Steve Lloyd has more than 20 years experience in data
communications and distributed systems security. His areas of
expertise include distributed message handling systems and
directory services, TCP/IP, security protocols, security
architectures, and large-scale Public-Key Infrastructure policy and
technology. He is currently manager of IT security consulting at
AEPOS Technologies Corporation.
0672323915AB10042002