x.509-Directory Authentication Service

x.509-Directory Authentication Service

• 1.
  X.509-DIRECTORY AUTHENTICATION SERVICE
• 2.
  X.509 Authentication Service Introduction„ ITU-TX.509:  Part of X.500 Directory Services  Issued in 1988; revised in 1993 and 1995  Defines a framework for authentication service using the X.500 directory  Repository of public-key certificates„  Based on use of public-key cryptography and digital signatures  Recommends use of RSA
• 3.
  Public-key Certificates„  Associatedwith user  Created by trusted third party  Certificate authority (CA)  Placed in directory by CA or by the user  Directory server  „location for certificate access  does not create the certificates
• 4.
  X.509 Certificate Format Thegeneral format for a certificate is:  „Version V  „Serial number SN  „Signature algorithm identifier AI  „Issuer Name CA  „Period of Validity TA
• 5.
   „Subject NameA  „Subject’s Public-key Information Ap  „Issuer Unique Identifier (added in Version 2)  „Subject Unique Identifier (added in Version 2)  „Extensions (added in Version 3)  „Signature
• 6.
  X.509 Standard Notation „User certificates generated by a CA use the following standard notation:  CA<<A>> = CA {V, SN, AI, CA, TA, A, Ap} where Y<<X>> = the certificate of user X issued by the certification authority Y Y {I} = the signing of I by Y consisting of I with an encrypted hash code appended.
• 7.
  X.509: Obtaining AUser Certificate user certificates generated by a CA have the following characteristics:  „Any user with access to the public key of the CA can recover the user public key that was certified.  „No party other than the CA can modify the certificate without being detected.  „Since they are unforgeable,they can be placed in a directory without the need for the directory to make special efforts to protect them.
• 8.
  X.509: CA TrustIssues  If all users subscribe to the same CA, then there is a common trust of that CA.  „All user certificates can be placed in the directory for access by all users.  „Any user can transmit his/her certificate directly to other users.  „Once B is in possession of A’s certificate, B has confidence that:  „Messages it encrypts will be secure.  „Messages signed with A’s private key are unforgivable.
• 9.
  X.509: Multiple CAs „Large User Community  „Not Practical to Support All Users  „More Practical to Have Multiple CAs  „Each CA Provides Its Public Key to A Smaller User Group
• 10.
  X.509: Authentication Procedures Threealternative authentication procedures for X.509 Directory Authentication Service  „Each use public-key signatures  „Each assumes that two parties know each other’s public key.  „either obtained from Directory  „or obtained in an initial message