Understanding PKI: Concepts, Standards, and Deployment Considerations, Second Edition

Understanding PKI: Concepts, Standards, and Deployment Considerations, Second Edition

Released November 2002
Publisher(s): Addison-Wesley Professional
ISBN: 9780672323911

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

PKI (public-key infrastructure) enables the secure exchange of data over otherwise unsecured media, such as the Internet. PKI is the underlying cryptographic security mechanism for digital certificates and certificate directories, which are used to authenticate a message sender. Because PKI is the standard for authenticating commercial electronic transactions, Understanding PKI, Second Edition, provides network and security architects with the tools they need to grasp each phase of the key/certificate life cycle, including generation, publication, deployment, and recovery.

Table of contents

  1. Copyright
    1. Dedication
  2. Foreword
  3. Preface
    1. Motivations for PKI
    2. Changes in the Second Edition
    3. Audience
    4. Organization
    5. Part I: Concepts
    6. Part II: Standards
    7. Part III: Deployment Considerations
  4. About the Authors
  5. I. Concepts
    1. 1. Introduction
    2. 2. Public-Key Cryptography
      1. Symmetric versus Asymmetric Ciphers
        1. Secret Key
          1. The Need for Secret Key Exchange
          2. Communications Difficulties between Unknown Entities
          3. Difficulties of Scale
          4. Symmetric Central Server Architectures
        2. New Directions: Public Key
      2. Public/Private-Key Pair
      3. Services of Public-Key Cryptography
        1. Security between Strangers
        2. Encryption
        3. Digital Signature
        4. Data Integrity
        5. Key Establishment
        6. Other Services
      4. Algorithms
        1. RSA
        2. DSA
        3. DH
        4. ECDSA and ECDH
        5. SHA-1
        6. Ongoing Work
      5. Summary
    3. 3. The Concept of an Infrastructure
      1. Pervasive Substrate
      2. Application Enabler
        1. Secure Sign-On
          1. Secure Single Sign-On
        2. End-User Transparency
        3. Comprehensive Security
      3. Business Drivers
      4. Public-Key Infrastructure Defined
        1. Certification Authority
        2. Certificate Repository
        3. Certificate Revocation
        4. Key Backup and Recovery
        5. Automatic Key Update
        6. Key History
        7. Cross-Certification
        8. Support for Non-repudiation
        9. Time Stamping
        10. Client Software
      5. Summary
    4. 4. Core PKI Services: Authentication, Integrity, and Confidentiality
      1. Definitions
        1. Authentication
          1. Entity Identification: Local versus Remote
          2. Entity Identification: Single Factor versus Multifactor
          3. Authentication as a PKI Service
        2. Integrity
        3. Confidentiality
      2. Mechanisms
        1. Authentication
        2. Integrity
        3. Confidentiality
      3. Operational Considerations
        1. Performance
        2. On-line versus Off-line Operation
        3. Commonality of Underlying Algorithms
        4. Entity Naming
      4. Summary
    5. 5. PKI-Enabled Services
      1. Secure Communication
      2. Secure Time Stamping
      3. Notarization
      4. Non-repudiation
        1. Connection with Other Services
        2. Need for a Secure Data Archive
        3. Complexity of This Service
        4. The Human Factor
      5. Privilege Management
        1. Authentication and Authorization
        2. Authorization Authorities
        3. Delegation
        4. Connection with the PKI
      6. Privacy
      7. Mechanisms Required to Create PKI-Enabled Services
        1. Digital Signatures, Hashes, MACs, and Ciphers
        2. Trusted Time Sources
        3. Privilege Policy Creation Mechanism
        4. Privilege Policy Processing Engines
        5. Privilege Management Infrastructure Mechanisms
        6. Privacy Architecture
      8. Operational Considerations
        1. Trusted Time Delivery Mechanism
        2. Secure Protocols
        3. Server Redundancy
        4. Physically Secure Archive Facilities
        5. Privacy Certificates and Identity Mapping
        6. Real Life
      9. Comprehensive PKI and Current Practice
      10. Summary
    6. 6. Certificates and Certification
      1. Certificates
        1. Digital Certificate
        2. Certificate Structure and Semantics
        3. Alternative Certificate Formats
          1. SPKI
          2. PGP
          3. SET
          4. Attribute Certificates
      2. Certificate Policies
        1. Object Identifiers
        2. Policy Authorities
      3. Certification Authority
      4. Registration Authority
      5. Summary
    7. 7. Key and Certificate Management
      1. Key/Certificate Life-Cycle Management
        1. Initialization Phase
          1. End-Entity Registration
          2. Key Pair Generation
          3. Certificate Creation and Key/Certificate Distribution
          4. Certificate Dissemination
          5. Key Backup
        2. Issued Phase
          1. Certificate Retrieval
          2. Certificate Validation
          3. Key Recovery
          4. Key Update
        3. Cancellation Phase
          1. Certificate Expiration
          2. Certificate Revocation
          3. Key History
          4. Key Archive
      2. Summary
    8. 8. Certificate Revocation
      1. Periodic Publication Mechanisms
        1. Certificate Revocation Lists (CRLs)
          1. Per-Entry Extensions
          2. Per-CRL Extensions
          3. Private Extensions
        2. Complete CRLs
        3. Certification Authority Revocation Lists (CARLs)
        4. End-entity Public-key Certificate Revocation Lists (EPRLs)
        5. CRL Distribution Points
        6. Redirect CRLs
        7. Delta and Indirect Delta CRLs
        8. Indirect CRLs
        9. Certificate Revocation Trees (CRTs)
        10. On-line Query Mechanisms
        11. Online Certificate Status Protocol (OCSP)
          1. Understanding OCSP's Limitations
        12. Simple Certificate Validation Protocol (SCVP)
      2. Other Revocation Options
      3. Performance, Scalability, and Timeliness
      4. Summary
    9. 9. Trust Models
      1. Strict Hierarchy of Certification Authorities
      2. Loose Hierarchy of Certification Authorities
      3. Policy-Based Hierarchies
      4. Distributed Trust Architecture
        1. Mesh Configuration
        2. Hub-and-Spoke Configuration
      5. Four-Corner Trust Model
      6. Web Model
      7. User-Centric Trust
      8. Cross-Certification
      9. Entity Naming
      10. Certificate Path Processing
        1. Path Construction
        2. Path Validation
        3. Trust Anchor Considerations
      11. Summary
    10. 10. Multiple Certificates per Entity
      1. Multiple Key Pairs
      2. Key Pair Uses
        1. Relationship between Key Pairs and Certificates
      3. Real-World Difficulties
      4. Independent Certificate Management
      5. Support for Non-repudiation
      6. Summary
    11. 11. PKI Information Dissemination: Repositories and Other Techniques
      1. Private Dissemination
      2. Publication and Repositories
        1. Locating Repositories
        2. Tradeoffs
      3. Interdomain Repository Issues and Options
        1. Direct Access
        2. Border Repository
        3. Shared Repository
        4. Interdomain Replication
      4. In-band Protocol Exchange
      5. Summary
    12. 12. PKI Operational Considerations
      1. Client-Side Software
      2. Off-line Operations
      3. Physical Security
      4. Hardware Components
      5. User Key Compromise
      6. Disaster Preparation and Recovery
        1. Relying Party Notification
        2. Preparation
        3. Recovery
        4. Additional Observations
      7. Summary
    13. 13. Electronic Signature Legislation and Considerations
      1. Electronic Signature Legislation
        1. E-Sign
        2. Digital Signatures in Context
        3. EU Electronic Signature Directive
        4. The Significance of Electronic Signature Initiatives
      2. Legal Considerations for PKIs
        1. CA Requirements
        2. Roles and Responsibilities
          1. Subscriber Responsibilities
          2. CA Responsibilities
          3. Relying Party Responsibilities
        3. Private Enterprise PKIs
        4. Other Contractual-Based Frameworks
      3. Confidentiality
      4. Summary
    14. 14. PKI in Practice
      1. What PKI Does
      2. What PKI Does Not Do
      3. The Value of PKI
      4. When Certificates and People Meet
        1. An E-mail Scenario
        2. A Web Scenario
      5. Summary
    15. 15. The Future of PKI
      1. What Happened?
      2. How the World Is Changing
        1. A Recognized Authoritative Body
        2. A Motivation
        3. Users
      3. Reasons for Cautious Optimism
      4. Summary
    16. 16. Conclusions and Further Reading
      1. Conclusions
      2. Suggestions for Further Reading
        1. Bibliography
  6. II. Standards
    1. 17. Introduction
    2. 18. Major Standards Activities
      1. X.509
      2. PKIX
      3. X.500
      4. LDAP
      5. ISO TC68
      6. ANSI X9F
      7. S/MIME
      8. IPsec
      9. TLS
      10. SPKI
      11. OpenPGP
      12. EDIFACT
      13. IEEE
      14. WAP
      15. XML-Based Activities
      16. Other Activities
        1. U.S. FPKI
        2. MISPC
        3. GOC PKI
        4. SET
        5. SEMPER
        6. ECOM
        7. JCP
        8. ICE-CAR
      17. Summary
    3. 19. Standardization Status and Road Map
      1. Current Standardization Status
        1. X.509
        2. PKIX
        3. X.500
        4. LDAP
        5. S/MIME
        6. IPsec
        7. TLS
        8. Toolkit Requirements (APIs and Mechanisms)
        9. Others
      2. Ongoing Standardization Work
      3. Summary
    4. 20. Standards: Necessary but Not Sufficient
      1. The Role of Standards, Profiles, and Interoperability Testing
        1. Profiles and Interoperability Testing
      2. Interoperability Initiatives
        1. Automotive Network eXchange
        2. Bridge CA Demonstration
        3. Federal PKI
        4. Minimum Interoperability Specification
        5. National Automated Clearing House Association
        6. PKI X.509
        7. Securities Industry Root CA Proof of Concept
        8. EEMA PKI Challenge
      3. Summary
    5. 21. Conclusions and Further Reading
      1. Conclusions
      2. Suggestions for Further Reading
        1. Certificate/CRL Syntax and Life-Cycle Management Protocols
        2. Certificate/CRL Storage and Retrieval
        3. XML-Based Initiatives
        4. Interoperability Initiatives
        5. Standards Bodies' Web Sites
        6. Books
          1. Bibliography
  7. III. Deployment Considerations
    1. 22. Introduction
    2. 23. Benefits and Costs of a PKI
      1. Business Case Considerations
      2. Cost Considerations
      3. Deployment: Now or Later?
      4. Summary
    3. 24. Deployment Issues and Decisions
      1. Trust Models: Hierarchical versus Distributed
      2. In-sourcing versus Out-sourcing
      3. Build versus Buy
      4. Closed versus Open Environment
      5. X.509 versus Alternative Certificate Formats
      6. Targeted Applications versus Comprehensive Solution
      7. Standard versus Proprietary Solutions
      8. Interoperability Considerations
        1. Certificate and CRL Profiles
        2. Multiple Industry-Accepted Standards
        3. PKI-Enabled Applications
        4. Policy/Business Control Issues
      9. On-line versus Off-line Operations
      10. Peripheral Support
      11. Facility Requirements
      12. Personnel Requirements
      13. Certificate Revocation
      14. End-Entity Roaming
      15. Key Recovery
      16. Repository Issues
      17. Disaster Planning and Recovery
      18. Security Assurance
      19. Mitigating Risk
      20. Summary
    4. 25. Barriers to Deployment
      1. Repository Issues
        1. Lack of Industry-Accepted Standard
        2. Multivendor Interoperability
        3. Scalability and Performance
      2. Knowledgeable Personnel
      3. PKI-Enabled Applications
      4. Corporate-Level Acceptance
      5. Summary
    5. 26. Typical Business Models
      1. Internal Communications Business Model
      2. External Communications Business Models
        1. Business-to-Business Communication
        2. Business-to-Consumer Communication
      3. Internal/External Business Model Hybrids
      4. Business Model Influences
      5. Government-Sponsored Initiatives
      6. Interdomain Trust
        1. Identrus
        2. Bridge CA
        3. VeriSign Trust Network
        4. GTE CyberTrust/Baltimore Technologies OmniRoot
        5. Other Trust Networks
      7. Summary
    6. 27. Conclusions and Further Reading
      1. Conclusions
      2. Suggestions for Further Reading
  8. References

Product information

  • Title: Understanding PKI: Concepts, Standards, and Deployment Considerations, Second Edition
  • Author(s):
  • Release date: November 2002
  • Publisher(s): Addison-Wesley Professional
  • ISBN: 9780672323911