Introduction to PKI

• A public-key infrastructure (PKI) is a set of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates and manage public-key encryption.
• The purpose of a PKI is to facilitate the secure electronic transfer of information for a range of network activities such as e-commerce, internet banking, and confidential email.
• It is required for activities where simple passwords are an inadequate authentication method and more rigorous proof is required to confirm the identity of the parties involved in the communication and to validate the information being transferred.

Certificate

• A public-key certificate is a digitally signed statement from one entity, saying that the public key of another entity has some specific value.
• In a typical public-key infrastructure (PKI) scheme, the certificate issuer is a certificate authority (CA), usually a company that charges customers to issue certificates for them.

Terms Definition

• Digitally Signed
  • If some data is digitally signed it has been stored with the “identity” of an entity, and a signature that proves that entity knows about the data. The data is rendered unforgeable by signing with the entity’s private key.
• Identity
  • A known way of addressing an entity. In some systems the identity is the public key, in others it can be anything from a Unix UID to an Email address.
• Entity
  • An entity is a person, organization, program, computer, business, bank, or something else you trust to some degree.

Why We Need CA?

• In a large-scale networked environment, it is impossible to guarantee that prior relationships between communicating entities have been established or that a trusted repository exists with all used public keys
• Certificates were invented as a solution to this public key distribution problem. Now a Certification Authority (CA) can act as a Trusted Third Party.
• CAs are entities (e.g., businesses) that are trusted to sign (issue) certificates for other entities.
• It is assumed that CAs will only create valid and reliable certificates as legal agreements bind them.

Who uses Certificates?

• The most widely visible application of X.509 certificates today is in web browsers supporting the SSL protocol.
  • SSL (Secure Socket Layer) is a security protocol that provides privacy and authentication for network traffic. These browsers can only use this protocol with web servers that support SSL.

How to create a certificate?

• There are two basic techniques used to get certificates:
  • You can create one yourself (using the right tools, such as keytool)
  • You can ask a Certification Authority to issue you one (either directly or using a tool such as keytool to generate the request)