Datasheet

“main” (Installation and Administration) — 2004/6/25 — 13:29 — page 621 — #647
i
i
i
i
i
i
i
i
26
Security in the Network
Key Authenticity
Because the public key process is in widespread use, there are many public
keys in circulation. Successful use of this system requires that every user
be sure that a public key does indeed belong to the assumed owner. The
assignment of users and public keys will be confirmed by trustworthy in-
stances by means of public key certificates. Such certificates contain the
name of the key owner, the corresponding public key, and the electronic
signature of the person issuing the certificate. Trustworthy instances are
usually part of a certification infrastructure that, in addition to issuing and
signing certificates, is also responsible for the other aspects of certificate
management. This includes publication, withdrawal and renewal of certifi-
cates. An infrastructure of this kind is generally referred to as a public key
infrastructure or PKI. One familiar PKI is the OpenPGP standard in which
users publish their certificates themselves without central authorization
points. These certificates become trustworthy when signed by other parties
in the “web of trust.”
The hierarchically structured X.509 Public Key Infrastructure (PKIX) is an al-
ternative model defined by the IETF (Internet Engineering Task Force that
now acts as an exemplar for almost all publicly-used PKIs. In this model,
authentication is carried out in a hierarchical tree structure by certifica-
tion authorities (CA). The root of the tree is formed by the root CA, which
certifies all sub-CAs or the next level own to the sub-CAs of the lowest
level which issue user certificates. The user certificates become trustwor-
thy through certification by the next highest sub-CAs, which in turn have
been certified by the higher levels of the hierarchy. This creates a certifica-
tion path that ends with the root CA.
The security of such a PKI stands and falls with the trustworthiness of the
CA certificates. To make certification practices transparent for PKI cus-
tomers, the PKI operator defines a certification practice statement (CPS) in
which the procedures for certificate management are defined. This should
ensure that the PKI only issues trustworthy certificates.
X.509 Certificates
An X.509 certificate is a data structure with several fixed fields and (op-
tional) additional extensions. The fixed fields mainly contain the name
of the key owner, the public key, and the data relating to the issuing CA
(name and signature). For security reasons, a certificate should only have a
limited period of validity, so a field is also provided for this date. The CA
guarantees the validity of the certificate in the specified period. The CPS
usually stipulates that the PKI (in other words, the CA in the final analysis)
should create and distribute a new certificate before validity lapses.
621SUSE LINUX Enterprise Server