Digital certificate
One. Digital Certificate Overview Digital Certificate is a data containing user identity information, user public key information, and authentication agency digital signature. The digital signature of the authentication body ensures authenticity of the certificate information, and the user public key information ensures the integrity of the digital information transmission, and the user's digital signature ensures the undisurableness of the digital information. Digital certificates are the identity of various terminal entities and end users to communicate online and business activities. All parties in electronic transactions, all parties to the transaction need to verify the effectiveness of the other party's digital certificate, thereby solving the problem of mutual trust . Digital Certificate is a file containing the public key owner information and the public key with a certificate authentication center (CA) digital signature. The Certification Center (CA) is an authoritative, trustworthy, just third-party agency, specializing in providing digital certificate services for various certification needs. Digital certificates issued by the Certification Center followed the X.509 V3 standard. The X.509 standard has been widely accepted in ordering of public key password format. The X.509 certificate is applied to many network security, including IPSec (IP Security), SSL, SET, S / MIME. two. The necessity of the application of the digital certificate mainly includes the following aspects:
Authentication Information Transfer Safety Information Confidentiality (Storage and Transaction) (Non-Repudiation) The security requirements of digital information are resolved by the following means:
Data Secureness ---- Integrity of Encrypted Data ---- Digital Signature Identification ---- Digital Certificate and Digital Signature Unsciousness ---- Digital Signature In order to ensure the authentication and information transfer of both parties Safety, currently using digital certificate technology, thereby implementing confidentiality, authenticity, integrity, and non-sense of transmission information. three. The digital certificate content and format digital certificate include the information of the certificate applicant and the information of the certificate CA, and the digital certificates issued by the Certification Center follow the X.509 V3 standard. The format of the digital certificate is defined in the ITU standard and X.509 V3. According to this standard, the digital certificate includes information of the certificate applicant and the information of the certificate CA. X.509 Digital Certificate Content: The meaning of each part of the certificate:
area
meaning
Version certificate version number, different versions of the certificate format Different Serial Number serial numbers, the same authentication body issued a certificate serial number, the only Algorithm Identifier signature algorithm, including the necessary parameter Issuer authentication agency ID information Period of validity validity Subject certificate hold People's Identification Information Subject's Public Key Certificate Holder's Public Key Signature Authentication Authority Signature of the Certificate
The content consists of the following two parts: (1) Applicant's information The first part of the applicant's information, the data in the digital certificate includes the following information: version information, used to compatibility with the future version of X.509; certificate serial number, each A certificate issued by the CA must have a unique serial number; the signature algorithm used; the name of the certificate CA; the validity of the certificate; the certificate topic name; the proven public key information, including public key algorithm, public key A bit string is represented; a special extension containing additional information. (2) Distribution CA information The second part of the CA information, the digital certificate contains the signature of the issuance certificate CA and the signature algorithm used to generate digital signatures. Any person can use the signature algorithm to verify whether the certificate is issued by the CA's signature key. four. When verifying the certificate holder, when he is communicating with the holder, he first looks on the database and gets a certificate path from the Certification path and the public key of B. At this time, the A-directional or two-way verification certificate can be used. One-way verification is unidirectional communication from Party B. It establishes the proof of the identity of A and B and the integrity of any communication information from Party B. It also prevents any attacks during communication. Two-way verification is similar to one-way verification, but it adds answers from B. It guarantees that B is not a response sent by the cage. It also guarantees the confidentiality of both parties and prevents attacks. One-way and bidirectional verification uses time tags. One-way verification is as follows: (1) A random number RA is generated. (2) A message, M = (Ta, Ra, Ib, D), where Ta is the time tag of the A, IB is the identification of B, D is any one of the data information. For safety, the data can be encrypted by the public key EB of B. (3) A will be sent to B (CA, DA (M)). (CA is a certificate, DA is a private key) (4) B confirm CA and EA. He confirmed that these keys did not expire. (EA is the public key) (5) B Use EA to decrypt DA (M), which is proved that the signature of the letter has proven the integrity of the issued information. (6) In order to accurately, B check IB in m. (7) The TA in the M is examined to confirm that the message is just sent. (8) As an option, B is checked to check the RA in the Old random database to ensure that the message is not the old message playback. Bidirectional verification includes one-way verification and a similar one-way verification from B to A. In addition to completing the one-way verification (1) to (8), bidirectional verification also includes: (9) B production of another random number, RB. (10) A message, MM = (Tb, Rb, Ia, Ra, D), where TB is the time label of B, IA is the identity of the A, D is any data. In order to ensure safety, the public key of Available A can be encrypted. Ra is the random number generated in step (1). (11) B is sent to the DB (mm). (12) A decryption DB (mm) by EA to confirm the signature of B.
(13) In order to accurately, the AIA examination is IA in MM. (14) A TB in the mm and confirm that the message is just sent. (15) As an option, the A can check the RB in the mm to ensure that the message is not the old message of playback. Fives. Digital Certificate uses each user with a different name, a trusted certificate authentication center (CA) assigns a unique name to each user and issues a certificate containing the name and user public key. If you want to communicate with B, he must first get a certificate from B. and then verify it. If they use the same CA, things are very simple. A only need to verify the signature of the CA on the B certificate; if they use different CAs, the problem is complicated. A must start from the bottom of the tree structure of the CA, from the bottom CA to the upper layer CA, have been tracked to the same CA, find a common trust CA. Certificates can be stored in a database in the network. Users can use the network to exchange certificates from each other. When the certificate is revoked, it will be removed from the certificate directory, but the CA issued by this certificate will still retain the copy of this certificate to resolve the possible disputes in the future. If the user's key or the key of the CA is destroyed, it causes the certificate of cancellation. Each CA must retain a certificate abolition (CRL) that has been revoked but has not expired. When A new certificate receives a new certificate, you should check if the certificate has been revoked from the certificate abolition list (CRL). The existing persistent person's armor is transmitted to the number of information. In order to ensure the authenticity, integrity, and undenny of information transfer, the information to be transmitted is required to digital encryption and digital signatures. The transfer process is as follows: (1 ) A number of digital information to be transmitted (plain text). (2) A Hash operation for digital information to obtain a summary of information. (3) A digital signature of the information is encrypted with its own private key (SK), and it is attached to the digital information. (4) A randomness generates an encryption key (DES key), and uses this key to encrypt the information to be transmitted to form a ciphertext. (5) A public key (PK) of B is encrypted, and the encrypted DES key is transmitted together with the secret to B. (6) A cipher text transferred from the armor and the encrypted DES key, first decrypt the encrypted DES key with its own private key (SK) to get the DES key. (7) Since then, use the DES key to decrypt the received ciphertext, obtain the digital information of the plaintext, and then discard the DES key (ie the DES key is invalid). (8) A digital signature of the public key (PK) with A. is decrypted to obtain a summary of information. B is a new information summary for the applying the same HASH algorithm to receive a new information. (9) B will compare the information summary and the newly generated information summary, if consistent, the received information is not modified. six. Certificate storage method Digital certificate can be stored in a computer's hard drive, portable floppy disk, IC card or CUP card. When the user's digital certificate is stored in the computer hard disk, the use of convenient use, but the PC where the certificate must be secured, otherwise the certificate may be stolen once it is attacked. The use of floppy disk saves certificates, and the possibility of stealing is reduced, but the floppy disk is easily damaged. Once damage, the certificate will not be used.
