COEN 351 Certificates PKI X 509 Standard Certificates

COEN 351 Certificates, PKI, X 509 Standard

Certificates n THE authentication mechanism for Ecommerce. n n Allows customers to authenticate the e-merchant. Misrepresentation of e-merchants is the goal of phishing.

Certificates n Working Mechanism n n Certificate is a signed message containing an (emerchants) public key. Signer needs to be trusted. n n Signer public key needs to be loaded at user workstation. User needs to be able to trust that key.

Certificates OS Vendor installs CA public key in Browser ECA Browse to website Sends ECA(Ms. Li, ELi), ELi(Session Key) Authenticates by using session key. Certification Authority

Certificates n Key distribution n n Crucial for authentication, privacy, signing, … Public Key Technology can use Certificates n Certificate Authority (CA) generates certificates: n n Certificate = (Name, Public Key)signed by CA All nodes need to be preconfigured with public key by CA.

Certificate Authority vs. Key Distribution Center n CA in contrast to KDC: n n CA does not need to be online. CA not a distributed computing entity. n n n CA crash merely prevents setting up new users. Certificates are not security sensitive. They can be stored anywhere with universal read privileges. n n Deleting a certificate would disable the use of the public key. A compromised CA cannot read conversations, fake conversations, … n n Simpler, hence more secure. However, it can issue bogus certificates. CA more secure, more convenient than KDC.

Certificate Revocation n A certificate guarantees a public key. n n But public keys become unusable if the corresponding private key is stolen. Certificates should not be eternal n n They need an expiration date. CA needs to be able to revoke a public key.

Certificate Structure n Certificate includes: n n n User’s name User’s public key Expiration time Serial number of certificate CA name Issuing CA’s signature on the entire contents of the certificate.

Certificate Revocation n Certificate Revocation List (CRL) n n n Published periodically by each CA. Lists serial numbers of certificates that should not be honored. CRLs have issue time.

Certificate Revocation n Push or Pull model n n Pull: Users access CRL remotely. Push: Broadcast CRL. n n n Needs reliable distribution mechanism. Needs small CRL. US Do. D Multi-level Information System Security Initiative (MISSI) developed a PKI for the Defense Messaging System. n n Used CRL broadcasting only for revocation caused by key compromises. Reliable access to all participants.

Certificate Revocation n Make certificate revocation unnecessary by handing out only short-lived certificates.

Certificate Revocation Lists n CRLs n n CRLs can be very large. Publish mostly only a -list. n n n -list can be very short, often empty. Users update their private copy of the CRL. From time to time, publish a full list, or give only to new users.

Certificate Revocation Lists n First Valid Certificate n n Goal: Allow to compress CRLs. Certificates have no expiration date. CRL contains a first valid certificate field. All certificates with a serial number lower than the valid certificate field are invalid.

Certificate Revocation Lists n On-Line Revocation Service (OLRS) n n n System can be queried over the net whether a certificate is invalid. If unavailable, Alice can choose to accept certificates on trust. OLRS certificates n OLRS can issue a certificate stating: n “Bob’s certificate is valid as of 6: 05 GMT, January 20, 2005. ”

Certificate Revocation Lists n Good Lists vs. Bad Lists n n Good lists are much bigger. Good list publishes all licenses. n n Hence, good list contains hashes of certificates. Good lists solve one security problem: n n A CA employee can issue a bogus certificate off the books, possibly reusing a valid serial number. The bogus certificate cannot be put on the bad list, but the good list can be audited.

Certification Paths n Alice wants to communicate with Bob: n n n n Bob has a certificate from Cristal. Alice does not know Cristal. Therefore, Alice needs a certificate of Crystal’s public key. Crystal has a certificate from Dan. Alice does not know Dan. Therefore Alice needs a certificate of Dan’s public key. …

Trust Anchors n Alice needs to trust someone in the certificate chain. Alice Bob Microsoft Crystal Fred Dan Eve

Certificate Authorities n n Organization might have its own Certificate Authority. Independent Certificate Authorities are like notaries: n n n Trusted. Disinterested. Attesting to designated facts.

Public Key Infrastructure n PKI consists of the components necessary to securely distribute public keys. n n Certification Authorities Repository for retrieving certificates Method of revoking certificates Method of evaluation a chain of certificates

Public Key Infrastructure n n n Issuer: signs certificate with name and key. Subject: name contained in a certificate. Target: The name in the name-key association that someone wants to trust. Verifier / Relying Party: Evaluator of a chain of certificates. Principal: Anyone with a public key. Trust Anchor: public key that someone has decided to always trust.

PKI Trust Models n Monopoly: n There is one single CA in the world. n n n Vatican, US government, UN, Microsoft, Sun, Verisign, Chief rabbinate, … The key of the universal trust anchor could never be changed without causing mayhem. CA needs to verify every-one.

PKI Trust Model n Monopoly + Registration Authorities (RA) n n n Monopolistic CA chooses RAs all over the world. RA authenticate and issue certificates accordingly. RA receive a certificate signed by the CA. n In principle, a CA could check on what a RA does, but in general, they just rubber-stamp.

PKI Trust Model n n Monopoly + Delegated CA Monopolistic CA issues certificates to other CAs. n n Vouching for keys and vouching for trustworthiness. CAs issue their own certificates.

PKI Trust Model n Oligarchy n n n Allow for some / many root CAs Used in web browsers. Any wrongdoing at any of these CAs can cause serious trouble.

PKI Trust Model Verisign once certified Microsoft fraudulently.

PKI Trust Model n Anarchy n n n Used by PGP Users configure trust anchors, use rules on when to trust, … Everyone can issue certificates.

PKI Trust Model n Name constraints n n n Use internet name space. CA only trusted within a certain domain. SCU CA to be trusted with certifying SCU students, but not to be trusted with gwbush@whitehouse. com.

PKI Trust Model n Top-Down with name constraints n n Monopolistic: there is one root key. CAs responsible for their namespace. root . com . gov . edu . ucsc. edu . fr . uk . scu. edu. coen . de

PKI Trust Model n n n Bottom up with name constraints SCU can set up their own CA. So can UCSC. Eventually, they want to cross-link. Business opportunity to provide crosslink certification service, but business subject to competition.

Certificate Policies n Certificates can spell policies that limit the use of the certificate.

Certification Storage n n n With Issuer With Subject In a certificate repository. Choice depends on the PKI model.

Certificate Generation n n Creation of public / private key. Subject authentication

Certificate Distribution n Certificate can n n Accompany signature Distributed via web services

X. 509 Certificate Format X. 509 Version Number Serial Number Signature Algorithm Identifier Issuer (X. 500 Name) Validity Period (Start – Expiration dates / times) Subject (X. 500 Name) Subject Public Key Information: Algorithm Identifier, Public Key Value Issuer Unique Identifier Subject Unique Identifier CA Digital Signature

X. 500 Names X. 500 Name in Adobe Acrobat Digital Signature

X. 500 Names Root CA = US DN = {C=US, O=Santa Clara University, OU = Department USA of Computer Engineering, CN = O = Santa Clara University Thomas Schwarz, S. J. } Santa Clara University OU = Department of Computer Engineering Attributes: Telephon = 551 -6064 email = tjschwarz @scu. edu title = Associate Professor CN = Thomas Schwarz, S. J.

X. 500 Names n n X. 500 directory consists of a set of entries. Each entry is associated with one real-world object. n n n Person Device Organization Each object has a distinguished name (DN). Entry also has a set of attributes.

X. 500 Names n Entries logically organized in a directory tree. n n n Entries have attributes. Each link in the directory tree is labeled by an attribute type and a relative distinguished name (RDN). n n n Directory Information Tree (DIT) C ~ Country O ~ Organization OU ~ Organizational Unit CN ~ Common Name Distinguished names are formed by concatenating the labels on the way from root to the object.

X. 500 Names Root CA = US DN = {C=US, O=Santa Clara University, OU = Department USA of Computer Engineering, CN = O = Santa Clara University Thomas Schwarz, S. J. } Santa Clara University OU = Department of Computer Engineering Attributes: Telephon = 551 -6064 email = tjschwarz @scu. edu title = Associate Professor CN = Thomas Schwarz, S. J.

X. 500 Names n X. 500 names are unique, but can be reused. n I leave SCU, and ten years later they hire another Thomas Schwarz, S. J. n n This can be resolved by using two attributes as labels: n n Unlikely in my case, more likely for John Smith. CN = Thomas Schwarz, S. J. EN = 000023812 This is the reason why X. 509 uses unique identifiers. n Even though they are difficult to administer.

X. 509 Certificate Format X. 509 Version Number Serial Number Signature Algorithm Identifier Issuer (X. 500 Name) Validity Period (Start – Expiration dates / times) Subject (X. 500 Name) Subject Public Key Information: Algorithm Identifier, Public Key Value Issuer Unique Identifier Subject Unique Identifier CA Digital Signature

X. 509 Certificate Format n X. 509 uses identifiers for the methods used to form n n Issuer signature, Certified public key. These methods are objects that need to be registered. Objects have unique names, based on the Abstract Syntax Notation 1 Standard.

ASN. 1 n n Based on hierarchical structure. Top level uses integer values: n n 0 ITU-use 1 ISO use 2 joint ITU-ISO use. Second level depends on first level for different standards administered by the unit. n n Under 2, 16 specifies country. Under 2, 16, 840 specifies US.

ASN. 1 n n Based on hierarchical structure. Top level uses integer values: n n 0 ITU-use 1 ISO use 2 joint ITU-ISO use. Second level depends on first level for different standards administered by the unit. n n Under 2, 16 specifies country. Under 2, 16, 840 specifies US.

ASN. 1 0 1 2 16 (country) 840 (USA) Object-Identifier: {joint-iso-itu-t (2) country (16) us (840) organization (1) SCU (1589932) COEN (35) Algorithms (1) Super. Schwarz 1 (1) } 1 (Organization) 1589932 SCU 35 COEN 1 Algorithms 1 Super. Schwarz 1

ASN. 1 n It can happen that the same object gets different names. n The lower ranks of the tree are not administered centrally.

X. 509 Certificate Format n Naming is a problem. n n S/MIME uses X. 509 certificates. Needs to associate certificates with email addresses. n n n Insists that the name contains a component email=tjschwarz@scu. edu. Only reads this component. Later versions require to put email address under SUBJECTALTNAME.

X. 509 Certificate Format n Naming is a problem. n n SSL has a similar problem. URLs use the DNS system, not X. 500 n n Some browsers give up, just check whether the certificate is validly signed! Others insist that CN portion contains the DNS name.

X. 509 Certificate Format n Naming is a problem. n n X. 509 directory service largely non-existent. DNS exists.

X. 509 Certificate Format n X. 509 Version 3: n n n Single subject needs various public keys and hence various certificates. Application-specific naming Certificates have different levels of security, hence different levels of trust.

X. 509 Certificate Format n X. 509 Version 3: n Adds an extension field. n Extension field can contain various entries.

X. 509 v. 3 Certificate Format X. 509 Version Number = 3 Serial Number Signature Algorithm Identifier Issuer (X. 500 Name) Validity Period (Start – Expiration dates / times) Subject (X. 500 Name) Subject Public Key Information: Extension Algorithm Identifier, Public Key Value Extension Issuer Unique Identifier Extension Subject Unique Identifier Extensions CA Digital Signature Type Criticality Extension Field Value

X. 509 v. 3 Certificate Format n Naming no longer restricted to X. 500 naming system.

X. 509 v. 3 Certificate Format n New set of standard extensions. n n n Key information. Policy information. Subject and issuer attributes. Certification path constraints. Extensions related to CRLs.

PKIX n n Working group established by IETF in 1994. PKIX recommended extensions: n n n n Authority. Key. Identifier Subject. Key. Identifier Key. Usage Private. Key. Usage. Period Certificate. Policies Policy. Mappings Subject. Alt. Name

PKIX n PKIX recommended extensions: n n n Issuer. Alt. Name Subject. Directory. Attribute Basic. Constraints Name. Constraints Policy. Constraints Extended. Key. Usage CRLDistribution. Points Inhibit. Any. Policy Freshest. CRL Authority. Info. Access Subject. Info. Access

PKIX CRL n CRL entry contains n n n Signature Issuer This. Update (time CRL was issued. ) Next. Update User. Certificate n n n Revocation. Date CRLEntry. Extensions CRLExtensions Algorithm. Identifier Encrypted Repeats for each entry.

PKIX Online Certification Status Protocol n Implements online status checking for certificates. n n Real-time status checks. But data is valid for a validity window.

Other Standards n n PBP standard WAP WTLS n n DNSSEC n n Replaces ASN. 1 names with simpler ones. A type of a certificate for DNS environment only. SPKI (Simple PKI) RFC 2693,