PKI

PKI

1. X.509

   • Certificate Encode
     • PEM:Privacy Enhanced Mail
     • DER:Distinguished Encoding Rules
   • Certificate Extension Name
     • CRT
     • PEM
     • CER
     • KEY
     • PFX/P12
     • JKS
     • CSR: Certificate Signing Requst
   • `openssl` command
     • Generate self-sign certificate
       • openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem
     • Generate CSR
       • openssl req -newkey rsa:2048 -new -nodes -keyout my.key -out my.csr
     • Display the Certificate Information
       • PEM
         • openssl x509 -in certificate.pem -text -noout
       • DER
         • openssl x509 -in certificate.der -inform der -text -noout
   • Digital Certificate? or Public Key Certificate
     • Public Key + Owner Information + Digital Signature Signed by CA
   • Structure
     • Abstract Syntax Notation (ASN): describe the structure
       • ASN serves the same purpose as a DTD or an XSD might serve in an XML context
     • TOP level
       • version
       • serialNumber
       • signature
         • CA sign
         • Self-sign for test
         • object identifier (OID)
           • MD5withRSA: 1.2.840.113549.1.1.4 = 2A 86 48 86 F7 0D 01 01 04
           • SHA-1withRSA: 2A 86 48 86 F7 0D 01 01 05
       • issuer
         • Distinguished Name
       • validity
       • subject
       • subjectPublicKeyInfo
       • issuerUniqueID
       • subjectUniqueID
       • extensions

2. CA

   • CA sign the Digital certificate

3. RA

4. VA

5. Use Cases

   • SSL(TLS)
   • SAML
   • Software Licence
   • PDF signature
   • SSH

6. Algorithms

   • private key cryptography
     • DES，Data Encryption Standard
     • AES, Advanced Encryption Standard (128,192, 256)
     • RC4
     • IDEA
   • public key cryptography
     • RSA, Rivest, Shamir, Adleman: length>768 has not been cracked. So 1024 basic security and 2018 is more security
     • Digital Signature Algorithm, DSA, Only signature
     • Diffie-Hellman: Only for exchange key
     • ECC, Elliptic curve cryptography
   • Digest Algorithm
     • SHA Secure Hash Algorithm
       • SHA-1 : 160-bit
       • SHA-2: SHA256: 256-bit
     • MD5 Message-Digest Algorithm 5
     • CRC Cyclic Redundancy Check

Images and files in the map