1. Key Management
1.1. Handling
1.1.1. Escrow
1.1.1.1. Third-party stores and manges the key
1.1.2. Expiration
1.1.3. Renewal
1.1.3.1. An existing key can be renewed before it expires
1.1.4. Revocation
1.1.4.1. Revokes a key before its expiration date and is permanent.
1.1.5. Recovery
1.1.5.1. Key Recovery Agent (KRA)
1.1.5.1.1. Highly trused person responsible for recovering lost or damaged digital certificates
1.1.5.2. M-of-N Control
1.1.5.2.1. N Group
1.1.5.2.2. M Group
1.1.6. Suspension
1.1.6.1. Deactivates a key for a specific duration and can be reactivated.
1.2. Storage
1.2.1. Private
1.2.1.1. Smart cards or in tokens
1.2.2. Public
1.2.2.1. Imbedding them in certificates
1.2.2.2. Software repository
2. Transport Encryption Algorithms
2.1. Secure Socket Layer (SSL)
2.1.1. Transport Layer Security (TLS)
2.1.1.1. Extension of SSL
2.1.1.2. Protocol that guarantees privacy and data integrity between applications communicating over the internet
2.1.2. Developed by Netscape for securely transmitting documents over the internet.
2.1.3. Used for other application leve protocols such as FTP, LDAP and SMTP.
2.2. Secure Shell (SSH)
2.2.1. Encrypted alternative to Telnet protocol that is used to access remote computers.
2.2.2. Linux/UNIX based command interface.
2.3. Hypertext Transport Protocol over SSL (HTTPS)
2.3.1. Secure Hypertext Transport Protocol (SHTTP)
2.3.1.1. Related to HTTPS
2.3.1.2. Developed by Enterprise Integration Technology (EIT)
2.3.1.3. Allows clients and servers to negotiate independently encryption and digital signature methods in any combination in both directions.
2.3.2. Uses port 443 instead of HTTP's port 80
2.4. IP Security (IPsec)
2.4.1. OSI Layer
2.4.1.1. 7. Application
2.4.1.1.1. PGP
2.4.1.2. 6. Presentation
2.4.1.3. 5. Session
2.4.1.3.1. Kerberos
2.4.1.3.2. SSL
2.4.1.4. 4. Transport
2.4.1.4.1. TCP
2.4.1.5. 3. Network
2.4.1.5.1. IP
2.4.1.5.2. IPSec
2.4.1.6. 2. Data Link
2.4.1.7. 1. Physical
2.4.2. Two Encryption Modes
2.4.2.1. Tunnel
2.4.2.1.1. Encrypts the header and data postion.
2.4.2.2. Transport
2.4.2.2.1. Only encrypts the data portion (payload)
2.4.2.2.2. Used for communications behind a firewall. When leaving through the firewall, it will be tunnel encryption for communications from firewall to firewall.
2.4.3. Protection
2.4.3.1. 1. Authentication
2.4.3.1.1. Achieved through Authentication Header (AH) protocol.
2.4.3.2. 2. Confidentiality
2.4.3.2.1. Achieved through the Encapsulating Security Payload (ESP) protocol.
2.4.3.3. 3. Key Management
2.4.3.3.1. Achieved through the Association and Key Management Protocol/Oakley (ISAKMP/Oakly) protocol.
3. Digital Certificates
3.1. Defining
3.1.1. Technology used to associate a user's idenity to a public key that has been digitally signed by a trusted third-party.
3.1.2. Characteristics
3.1.2.1. Owner's name
3.1.2.2. Owner's public key
3.1.2.3. Name of issuer
3.1.2.4. Digital signature of the issuer
3.1.2.5. Serial number of the digital certificate
3.1.2.6. Expiration date of the public key
3.2. Managing
3.2.1. Certificate Authority (CA)
3.2.1.1. Serves as the third-party agency that is responsible for issuing the digital certificate.
3.2.1.2. Duties
3.2.1.2.1. Generate, issue and distributed public key certificates.
3.2.1.2.2. Distribute CA certificates
3.2.1.2.3. Generate and publish certificate statue
3.2.1.2.4. Provide a means for subscribers to request revocation
3.2.1.2.5. Revoke public-key certificates
3.2.1.2.6. Maintain the security, availability of the certificate issuance signing
3.2.1.3. The subscriber will generate the public and private keys and send the public key to the CA
3.2.2. Registration Authority (RA)
3.2.2.1. Subordinate entity designed to handle specific CA tasks such as processing certificate requests and authenticating users.
3.2.2.2. Local Registration Authorities (LRA)
3.2.2.2.1. "Off-loadin" these registration functions to one or more RAs that can be distributed in different geographic areas.
3.2.2.3. Sometimes the CA does the duties of the RA.
3.2.2.4. Duties
3.2.2.4.1. Recieve, authenticate and process certificate revocation requests.
3.2.2.4.2. Identify and authenticate subscribers
3.2.2.4.3. Obtain a public key from the subscriber
3.2.2.4.4. Verify that the subscriber possess the asymmetric private-key corresponding to the public-key submitted for certification.
3.2.2.5. Primary function of the RA is to verify the identity of the individual.
3.2.2.6. Authentication
3.2.2.6.1. Email
3.2.2.6.2. Documents
3.2.2.6.3. In person
3.2.3. Certificate Revocation List (CRL)
3.2.3.1. List all the revoked digital certificates.
3.2.3.2. Revoked Reasons
3.2.3.2.1. Certificate is no longer used.
3.2.3.2.2. Details of the certificate have changed.
3.2.3.2.3. Private-key has been exposed
3.2.3.2.4. Private-key has been lost
3.2.4. Certificate Repository (CR)
3.2.4.1. Web Browser Management
3.2.4.1.1. View default loaded certificates for a web browser.
3.2.4.1.2. Automatic updates will update the web browser automatically and download CRLs as needed.
3.2.4.2. Publically accessible centralized directory of digital certificates that can be used to view the statues of digital certificates.
3.3. Types
3.3.1. Class 1: Personal Digital Certificates
3.3.1.1. RA only requires the user's name and e-mail address in order to recieve certificate.
3.3.1.2. Used for personal e-mails, digital signatures and documents.
3.3.2. Class 2: Server Digital Certificates
3.3.2.1. Mainly used with webservers but can be used with other server types as well.
3.3.2.2. Functions
3.3.2.2.1. Ensure the authenticity of the server.
3.3.2.2.2. Ensure the authenticity of the cryptographic connection to the server.
3.3.3. Class 3: Software Publisher Digital Certificates
3.3.3.1. Verify that their programs are secure and have not been tampered with.
3.3.4. Class 4 is for online business transactions between companies.
3.3.5. Class 5 is for private organizations or governmental security.
3.3.6. Dual-Key Digital Certificates
3.3.7. Dual-Sided Digital Certificates
3.3.8. X.509 Digital Certificates
3.3.8.1. Most widely accepted format/standard for digital certificates defined by International Telecommunication Union (ITU)
4. Public Key Infrastructure (PKI)
4.1. Is the framework for all the entities involved in digital certificates for digital certificate management
4.2. Public-Key Cryptographic Standards (PKCS)
4.2.1. See page 463 and 464 (PKS 7 & 10)
4.3. Trusted Models
4.3.1. Hierarchical
4.3.1.1. Assigns a single hierarchy with one master CA called "root".
4.3.2. Distributed
4.3.2.1. Has multiple CAs that sign digital certificates.
4.3.3. Bridge
4.3.3.1. Acts as a "facilitator" to bridge Hierarchical and Distributed models.
4.3.3.2. Does not issues digital certificates
4.3.4. Third-party trust refers to a situation in which two individuals trust each other because each trusts a third party.
4.4. Managing
4.4.1. Certificate Policy (CP)
4.4.1.1. Published set of rules that govern the operation of PKI
4.4.2. Certificate Practice Statement (CPS)
4.4.2.1. Describes in detail how a CA uses and manages certificates.
4.4.3. Certificate Life Cycle
4.4.3.1. Creation
4.4.3.2. Suspenstion
4.4.3.2.1. Deactivates a certificate for a specific duration and can be reactivated.
4.4.3.3. Revocation
4.4.3.3.1. Revokes a certificate before its expiration date and is permanent.