Understanding PKI: Concepts, Standards, and Deployment Considerations / Edition 2

Understanding PKI: Concepts, Standards, and Deployment Considerations / Edition 2

by Carlisle Adams, Steve Lloyd
     
 

View All Available Formats & Editions

ISBN-10: 0672323915

ISBN-13: 9780672323911

Pub. Date: 11/28/2002

Publisher: Addison-Wesley

Public-Key Infrastructure (PKI) is the foundation of the four major elements of digital security: authentication, integrity, confidentiality, and non-repudiation. The idea of a public-key infrastructure has existed for more than a decade, but the need for PKI has intensified over the last few years as the Internet has expanded its reach into business,

Overview

Public-Key Infrastructure (PKI) is the foundation of the four major elements of digital security: authentication, integrity, confidentiality, and non-repudiation. The idea of a public-key infrastructure has existed for more than a decade, but the need for PKI has intensified over the last few years as the Internet has expanded its reach into business, government, the legal system, the military, and other areas that depend on secure communications.

Understanding PKI, Second Edition, is both a guide for software engineers involved in PKI development and a readable resource for technical managers responsible for their organization’s security policies and investments. It is a comprehensive primer to the latest in PKI technology and how it is used today. Taking a non-vendor-specific approach, this book explains fundamental concepts, examines emerging standards, and discusses deployment considerations and strategies that effect success.

This second edition has been updated throughout to incorporate all of the most recent developments in the PKI field. Two new chapters have been added to address the use of PKI in the real world and to explore the technology’s future. This new edition also addresses:

  • The X.509 standard
  • PKI for privacy
  • The emergence of electronic signatures and accompanying legislation
  • New PKI initiatives supported by the

    In addition to this specific information, the authors lend their informed opinions on how emerging trends will drive the expansion of PKI.

  • Product Details

    ISBN-13:
    9780672323911
    Publisher:
    Addison-Wesley
    Publication date:
    11/28/2002
    Edition description:
    Subsequent
    Pages:
    322
    Product dimensions:
    7.64(w) x 9.54(h) x 0.88(d)

    Table of Contents



    Foreword.


    Preface.


    About the Authors.

    I. CONCEPTS.

    1. Introduction.

    2. Public-Key Cryptography.

    Symmetric versus Asymmetric Ciphers.

    Secret Key.

    New Directions: Public Key.

    Public/Private-Key Pair.

    Services of Public-Key Cryptography.

    Security between Strangers.

    Encryption.

    Digital Signature.

    Data Integrity.

    Key Establishment.

    Other Services.

    Algorithms.

    RSA.

    DSA.

    DH.

    ECDSA and ECDH.

    SHA-1.

    Ongoing Work.

    Summary.

    3. The Concept of an Infrastructure.

    Pervasive Substrate.

    Application Enabler.

    Secure Sign-On.

    End-User Transparency.

    Comprehensive Security.

    Business Drivers.

    Public-Key Infrastructure Defined.

    Certification Authority.

    Certificate Repository.

    Certificate Revocation.

    Key Backup and Recovery.

    Automatic Key Update.

    Key History.

    Cross-Certification.

    Support for Non-repudiation.

    Time Stamping.

    Client Software.

    Summary.

    4. Core PKI Services: Authentication, Integrity, and Confidentiality.

    Definitions.

    Authentication.

    Integrity.

    Confidentiality.

    Mechanisms.

    Authentication.

    Integrity.

    Confidentiality.

    Operational Considerations.

    Performance.

    Online versus Offline Operation.

    Commonality of Underlying Algorithms.

    Entity Naming.

    Summary.

    5. PKI-Enabled Services.

    Secure Communication.

    Secure Time Stamping.

    Notarization.

    Non-repudiation.

    Connection with Other Services.

    Need for Secure Data Archive.

    Complexity of This Service.

    The Human Factor.

    Privilege Management.

    Authentication and Authorization.

    Authorization Authorities.

    Delegation.

    Connection with the PKI.

    Privacy.

    Mechanisms Required to Create PKI-Enabled Services.

    Digital Signatures, Hashes, MACs, and Ciphers.

    Trusted Time Sources.

    Privilege Policy Creation Mechanism.

    Privilege Policy Processing Engines.

    Privilege Management Infrastructure Mechanisms.

    Privacy Architecture.

    Operational Considerations.

    Trusted Time Delivery Mechanism.

    Secure Protocols.

    Server Redundancy.

    Physically Secure Archive Facilities.

    Privacy Certificates and Identity Mapping.

    Real Life.

    Comprehensive PKI and Current Practice.

    Summary.

    6. Certificates and Certification.

    Certificates.

    Digital Certificate.

    Certificate Structure and Semantics.

    Alternative Certificate Formats.

    Certificate Policies.

    Object Identifiers.

    Policy Authorities.

    Certification Authority.

    Registration Authority.

    Summary.

    7. Key and Certificate Management.

    Key/Certificate Life-Cycle Management.

    Initialization Phase.

    Issued Phase.

    Cancellation Phase.

    Summary.

    8. Certificate Revocation.

    Periodic Publication Mechanisms.

    Certificate Revocation Lists (CRLs).

    Complete CRLs.

    Certification Authority Revocation Lists (CARLs).

    End-Entity Public-Key Certification Revocation Lists (EPRLs).

    CRL Distribution Points.

    Redirect CRLs.

    Delta and Indirect Delta CRLs.

    Indirect CRLs.

    Certificate Revocation Trees (CRTs).

    Online Query Mechanisms.

    Online Certificate Status Protocol (OCSP).

    Simple Certificate Validation Protocol (SCVP).

    Other Revocation Options.

    Performance, Scalability, and Timeliness.

    Summary.

    9. Trust Models.

    Strict Hierarchy of Certification Authorities.

    Loose Hierarchy of Certification Authorities.

    Policy-Based Hierarchies.

    Distributed Trust Architecture.

    Mesh Configuration.

    Hub-and-Spoke Configuration.

    Four-Corner Trust Model.

    Web Model.

    User-Centric Trust.

    Cross-Certification.

    Entity Naming.

    Certificate Path Processing.

    Path Construction.

    Path Validation.

    Trust Anchor Considerations.

    Summary.

    10. Multiple Certificates per Entity.

    Multiple Key Pairs.

    Key Pair Uses.

    Relationship between Key Pairs and Certificates.

    Real-World Difficulties.

    Independent Certificate Management.

    Support for Non-repudiation.

    Summary.

    11. PKI Information Dissemination: Repositories and Other Techniques.

    Private Dissemination.

    Publication and Repositories.

    Locating Repositories 162Tradeoffs.

    Interdomain Repository Issues and Options.

    Direct Access.

    Border Repository.

    Shared Repository.

    Interdomain Replication.

    In-band Protocol Exchange.

    Summary.

    12. PKI Operational Considerations.

    Client-Side Software.

    Off-line Operations.

    Physical Security.

    Hardware Components.

    User Key Compromise.

    Disaster Preparation and Recovery.

    Relying Party Notification.

    Preparation.

    Recovery.

    Additional Observations.

    Summary.

    13. Electronic Signature Legislation and Considerations.

    Electronic Signature Legislation.

    E-Sign.

    Digital Signatures in Context.

    EU Electronic Signature Directive.

    The Significance of Electronic Signature Initiatives.

    Legal Considerations for PKIs.

    CA Requirements.

    Roles and Responsibilities.

    Private Enterprise PKIs.

    Other Contractual-Based Frameworks.

    Confidentiality.

    Summary.

    14. PKI in Practice.

    What PKI Does.

    What PKI Does Not Do.

    The Value of PKI.

    When Certificates and People Meet.

    An E-mail Scenario.

    A Web Scenario.

    Summary.

    15. The Future of PKI.

    What Happened?

    How the World Is Changing.

    A Recognized Authoritative Body.

    A Motivation.

    Users.

    Reasons for Cautious Optimism.

    Summary.

    16. Conclusions and Further Reading.

    Conclusions.

    Suggestions for Further Reading.

    II. STANDARDS.

    17. Introduction.

    18. Major Standards Activities.

    X.509.

    PKIX.

    X.500.

    LDAP.

    ISO TC68.

    ANSI X9F.

    S/MIME.

    IPsec.

    TLS.

    SPKI.

    OpenPGP.

    EDIFACT.

    IEEE.

    WAP.

    Other Activities.

    U.S. FPKI.

    MISPC.

    GOC PKI.

    SET.

    SEMPER.

    ECOM.

    JCP.

    ICE-CAR.

    Summary.

    19. Standardization Status and Road Map.

    Current Standardization Status.

    X.509.

    PKIX.

    X.500.

    LDAP.

    S/MIME.

    IPsec.

    TLS.

    Toolkit Requirements (APIs and Mechanisms).

    Others.

    Ongoing Standardization Work.

    Summary.

    20. Standards: Necessary but Not Sufficient.

    The Role of Standards, Profiles, and Interoperability Testing.

    Profiles and Interoperability Testing.

    Interoperability Initiatives.

    Automotive Network eXchange.

    Bridge CA Demonstration.

    Federal PKI.

    Minimum Interoperability Specification.

    National Automated Clearing House Association.

    PKI X.509.

    Securities Industry Root CA Proof of Concept.

    EEMA PKI Challenge.

    Summary.

    21. Conclusions and Further Reading.

    Conclusions.

    Suggestions for Further Reading.

    Certificate/CRL Syntax and Life-Cycle Management Protocols.

    Certificate/CRL Storage and Retrieval.

    Interoperability Initiatives.

    Standards Bodies' Web Sites.

    Books.

    III. DEPLOYMENT CONSIDERATIONS.

    22. Introduction.

    23. Benefits and Costs of a PKI.

    Business Case Considerations.

    Cost Considerations.

    Deployment: Now or Later?

    Summary.

    24. Deployment Issues and Decisions.

    Trust Models: Hierarchical versus Distributed.

    In-sourcing versus Out-sourcing.

    Build versus Buy.

    Closed versus Open Environment.

    X.509 versus Alternative Certificate Formats.

    Targeted Applications versus Comprehensive Solution.

    Standard versus Proprietary Solutions.

    Interoperability Considerations.

    Certificate and CRL Profiles.

    Multiple Industry-Accepted Standards.

    PKI-Enabled Applications.

    Policy/Business Control Issues.

    On-line versus Off-line Operations.

    Peripheral Support.

    Facility Requirements.

    Personnel Requirements.

    Certificate Revocation.

    End-Entity Roaming.

    Key Recovery.

    Repository Issues.

    Disaster Planning and Recovery.

    Security Assurance.

    Mitigating Risk.

    Summary.

    25. Barriers to Deployment.

    Repository Issues.

    Lack of Industry-Accepted Standard.

    Multivendor Interoperability.

    Scalability and Performance.

    Knowledgeable Personnel.

    PKI-Enabled Applications.

    Corporate-Level Acceptance.

    Summary.

    26. Typical Business Models.

    Internal Communications Business Model.

    External Communications Business Model.

    Business-to-Business Communication.

    Business-to-Consumer Communication.

    Internal/External Business Model Hybrids.

    Business Model Influences.

    Government-Sponsored Initiatives.

    Interdomain Trust.

    Identrus.

    Bridge CA.

    VeriSign Trust Network.

    GTE CyberTrust/Baltimore Technologies OmniRoot.

    Other Trust Networks.

    Summary.

    27. Conclusions and Further Reading.

    Conclusions.

    Suggestions for Further Reading.

    References.

    Index. 0672323915T10162002

    Customer Reviews

    Average Review:

    Write a Review

    and post it to your social network

         

    Most Helpful Customer Reviews

    See all customer reviews >