COEN 350 Public Key Infrastructure PKI n

COEN 350 Public Key Infrastructure

PKI n Task: Securely distribute public keys. n n Certificates. Repository for retrieving certificates. Method for revoking certificates. Method of evaluating a chain of certificates from public keys that are known and trusted in advance (TRUST ANCHOR).

PKI n Certificate n n A message signed by someone that vouches for someone else’s public key. {Alice’s public key is 891234567}Bob n n n Encrypted with Bob’s private key. If you trust that you have Bob’s public key, and if you trust Bob, then you now trust your new knowledge of Alice’s public key. Chain of certificates: n {Carol’s key is 901234567}Damian {Bob’s public key is 7890123456}Carol {Alice’s public key is 891234567}Bob

PKI n Alice signs a certificate vouching for Bob’s name and key: n n n Alice is verifying a chain of certificates: n n n Alice is the Issuer. Bob is the Subject. Alice is the verifier / relying party. Anything with a public key is a principal. A Trust Anchor is a public key that the verifier has decided to trust.

PKI Trust Model n Monopoly n n Everyone trust a single organization to be the only CA in the world. The key of that CA is embedded in all software and hardware as the PKI trust anchor.

PKI Trust Model n Monopoly n n n There is no universally trusted entity. How can the CA key ever be changed? CA needs to establish a trust relationship with you before it can give you a public key. Monopolist would have exclusive control. CA’s protection would be paramount.

PKI Trust Model n Monopoly plus Registration Authorities (RA) n n n Single monopoly CA chooses RAs to securely check identities and obtain and vouch for public keys. RAs securely send certification requests to CA. CA issues a certificate because it trusts the RAs.

PKI Trust Model n Monopoly with delegated CAs n Single trust anchor CA certifies other CAs. n n n Single trust anchor vouches for their public keys. Single trust anchor vouches for their trustworthiness. Users obtain certificates from any CA.

PKI Trust Model n Oligarchy n n Model used in browsers. A number of organizations set themselves up as trust anchors. n n Chances that one of these is corrupted is higher than the chance that a single trust anchor is corrupted. Product vendor selects amongst them.

PKI Trust Model n Oligarchy n n Model makes it easier to dupe users into accepting a trust anchor. Even knowledgeable users will have a hard time checking the 80+ trust anchors in a current browser.

PKI Trust Model n Anarchy n n Used by PGP. Each user is responsible for configuring some trust anchors themselves. n n n Meeting people who hand out there PGP fingerprint (a PGP hash of the public key) and send their public key in an email message. Search through public databases to find a path from one trust anchor to the key you want. But you implicitly trust everyone on that path!

PKI Name Constraints n n Trustworthiness of PKI is not a binary value. Trust MIT CA (run by undergrads) with MIT student public key, but not with the key of Washington officials.

PKI Name Constraints n Hierarchical names “tschwarz@cse. ucsd. edu” allow name based policies. n n Trust the cse CA for tschwarz. Trust the ucsd CA for cse. Trust the edu domain for edu. Allows users to use the same public keys for many different identities: tjschwarz@scu. edu, tschwarzsj@calprov. org, …

PKI Name Constraints n Top-Down with Name Constraints n n CAs cannot change keys but at the lowest level. Like Monopoly with delegated CA. n Delegates are restricted to part of the name hierarchy.

PKI Name Constraints n Bottom-Up with Name Constraints n n n Each organization can create its own PKI and link it to others. Parent certifies child (downlink), but child certifies parent as well (uplink). Crosslinks are links from one node to another one.

PKI Name Constraints scu. edu ucsc. edu cse. ucsc. edu ssrc. cse. ucsc. edu admissions. ucsc. edu soe. ucsc. edu cse. scu. edu scudc. scu. edu hadram. cse. scu. edu Bottom Up PKI model with two cross links (red) engr. scu. edu dc. engr. scu. edu ia. engr. scu. edu

PKI Name Constraints n n Even with a single cross-link from one tree into the other, we can establish a path from all nodes of the first tree to all of the other. Maintaining cross-links can be expensive. n Root service providers can provide these cross-links (for a fee).

PKI Name Constraints n Relative Names n Implement PKI bottom-up model with relative names. n n n Works for file systems. Open to research. Name constraints in certificates. n PKIX implements a Name Constraints field n Allows the issuer to specify what names the subject is trusted to certify.

PKI: Certificate Revocation n Revocation is necessary n n n Key is stolen. Someone leaves an organization. Certificates have therefore expiration dates. n n n Verisign offered cheap certificates for short lifeterms (1 -2 years). Afterwards, Verisign hiked the prices. Browsers were not checking expiration dates. Many system administrators noticed that and did not renew their Verisign certificates. Browsers now don’t want to enforce the expiration dates because of the many expired certificates.

PKI: Certificate Revocation n Certificate Revocation List (CRL) n Signed list of all revoked certificates. n n n First valid certificate: n n Timestamped (WHY? ) Delta CRL No expiration date. However, certificates before a certain serial number can be declared invalid. OLRS (On line revocation server). n Worst damage is that a revoked certificate is valid.

PKI: Certificate Revocation n Bad list n n Serial numbers of all bad certificates. Good list n n Serial numbers of all good certificates. Slightly more secure: n n A CA operator could be bribed to issue a certificate with a serial number from a valid certificate. The good list can detect the bogus certificate if it contains the serial number together with a cryptographic hash of the signature.

PKI and Directories n Directories can facilitate PKI, just as they work for DNS. n n Each entity is listed by name (tjschwarz@scu. edu) Associated with each name are data n n IP address Certificates it signed Certificates by others regarding it. Functionality can range from mere look-up (DSN) to query answering.

PKI n Storage of certificates n n With issuer With subject Speed and ease of revocation favor storing with issuer. Speed and ease of usage favor storing with subject.

X. 509 n X. 500 is an ITU-T recommendation for a directory service. n n n Directory is a server or a distributed set of servers that maintain a database of information about users. This includes a mapping from user name to network address. X. 509 is a framework for authentication servers for X. 500.

X. 509 n Certificate structure: n n n version serial number signature algorithm ID issuer name validity period subject (user) name subject public key information issuer unique identifier (version 2 and 3 only) subject unique identifier (version 2 and 3 only) extensions (version 3 only) signature on the above fields

X. 509 n n X. 509 has currently three versions The X. 509 standard is supported by n n PEM PKCS S-HTTP SSL.

X. 509 n Revocation of Certificates n n Each certificate has a period of validity. CRL is posted to the directory signed by the issuer and includes n n The issuer’s name. The date the list was created. The date the next CRL is going to come out. Each entry contains n n Serial number of certificate Revocation date.

X. 509 n Authentication Procedure n One-way authentication n A to B: n n Timestamp. Nonce. (which B has to store for a while to prevent replay attacks. ) Identity of B. Signed with A’s private key.

X. 509 n Authentication Procedure n Two-way authentication n Message from A to B: n n n Timestamp. Nonce. Identity of B. Signed with A’s private key. Message from B to A: n n n Timestamp. Nonce from B. Identity of A. Previous nonce from A. Signed with B’s private key.

X. 509 n Authentication Procedure n Three-way authentication n Message from A to B: n n n Message from B to A: n n n Timestamp. Nonce. Identity of B. Signed with A’s private key. Timestamp. Nonce from B. Identity of A. Previous nonce from A. Signed with B’s private key. Message from A to B: Signed copy of previous nonce from B. No longer necessary to keep nonces around. n n

X. 509 n X. 509 authentication also allows the exchange of a session key KAB. n A sends along the session key encrypted with B’s public key.

PKI: PKIX n PKIX is a profile of X. 500. n Decides which options of X. 50 x are implemented.

Further details in COEN 351.