Public Key Infrastructures PDF

03 Public Key Infrastructures Definition of a Public Key Infrastructure “ A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and...

03 Public Key Infrastructures Definition of a Public Key Infrastructure “ A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. ” DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 2 Purpose of a PKI The purpose of a PKI is the facilitation of secure electronic communication. Any sort of electronic transaction (banking, shopping,...) is based on communication. A PKI is required in situations where a simple password authentication is not sufficient. DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 3 PKI and Public Keys From a process-based perspective, a PKI binds public keys to identities. A public key has to be registered in the PKI providing a proof of identity. If the registration is successful, a certificate is issued, which proves the ownership of the public key. DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 4 Design of a PKI A PKI consists of several components: A certificate authority (CA) A registration authority (RA) A validation authority (VA) DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 5 Design of a PKI: Certificate Authority The CA stores, issues and signs the digital certificates. The CA is a trusted third party Both, owner and verifier of a certificate have to trust the CA DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 6 Design of a PKI: Registration Authority The RA verifies the identity of a person or organization requesting a certificate. For a personal certificate, a person has to be present at the RA and show a passport or the like. For functional certificates, other ways to proof the identity are common. DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 7 Design of a PKI: Registration Authority Example: Request a certificate for a webserver using Let's Encrypt as CA (1 / 2) A webserver is not a person, therefore nothing like a passport exists. However: It actually does not matter who requests the certificate, only the server itself has to be verified. Therefore, the requestor has to proof access to the server, which proves the validity of the request (in theory...). DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 8 Design of a PKI: Registration Authority Example: Request a certificate for a webserver using Let's Encrypt as CA (2 / 2) Let's Encrypt offers two challenges HTTP-01 DNS-01 HTTP-01 requires a special file to be available under a special path. DNS-01 requires a special DNS record to be set. DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 9 Design of a PKI: Validation Authority The VA verifies the validity of issued certificates. The CA provides a list of revoked certificates to the VA. The VA is publicly reachable, while the CA is not. DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 10 Design of a PKI CA CA VA RA Server DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 11 Problems with a CA Using a CA as root of trust has several disadvantages: Every party has to trust the CA. In case the CA's root certificate is compromised, every other certificate has to be revoked. DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 12 Alternative to a CA: Web of Trust Web of Trust uses a decentralized trust model. Basic idea: Alice signs Bob's public key. If Carol trusts Alice, she can also trust Bob's public key. Alice has to have a trustworthy way to verify Bob's public key. DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 13 Alternatives to a CA: Web of Trust Alice direct Bob trust indirect trust direct direct trust trust Carol Dave indirect trust DEPARTMENT OF ADVANCED COMPUTING SCIENCES, MAASTRICHT UNIVERSITY COMPUTER SECURITY | 14