PK-Enabling Toolkits August 27, 2001 1
CSOS Interfaces ENROLLMENT STATUS CHECKING Entrust X. 500 Web Connector Directory Network Interface: HTTP Port 80 Network Interface: LDAP v 3 Port 389 PKI Interface: PKCS 10 Request PKCS 7 Response PKI Interface: LDAP Request 2
CSOS Client Operations n Signing (FIPS 186 -2) l Signature Algorithm Support: DSA, RSA, ECC l Hash SHA-1 n Verification l Validity Check (Is the certificate expired? ) l Signature verification (SHA-1) l Certificate status check (LDAP) l Extension checks 3
How does choosing the right toolkit affect your application? n Toolkits vary in the functionality in which they support (Transparent key rollover, PKCS 11 support etc. ) n Some toolkits have features that may be only meaningful with specific CA products. (. epf) n Toolkits vary on which algorithms they support (RSA, Elliptical Curve, Diffie-Hillman etc. ) n Does the toolkit meet FIPS 140 -1 certification? 4
Issues n Are the toolkits standards-based? Interoperable with popular COTS PKI’s? n Support for PKCS #7 and PKCS #10 (Cert. Request and Response) n Support for PKCS #11 (Ability to store certificate on a smart card) If desired… n Certificate Store- How certificates and access to keys are managed 5
Issues (Continued) n Are toolkits affected by certain web browsers? (IE vs. Netscape) n Platform Support n FIPS Web Site http: //csrc. nist. gov/cryptval/ l l l RSA Crypto-C (Cert # 163; 8/15/2001) Microsoft CAPI Modules (Cert # 60, 68, 75, 103, 106, 110; 8/05/1999 to 08/15/2000 Entrust Crypto Kernel (Cert # 130; 12/20/2000) 6
Platform Support AIX Win 32 Solari s HP-UX Linux RSA BSafe x x Entrust SDK x x Microsoft x x CAPI 7
RSA BSAFE Toolkit n RSA BSAFE provides a line of products to support PK-Enabling applications. n Supports PKCS #7, PKCS #10 and PKCS #11 n Multi vendor support for Windows, Solaris, Linux, HP-UX, AIX n Support for all necessary algorithms n Customer support via. Professional Services Division 8
Microsoft Crypto API Toolkit n Microsoft’s Crypto API (CAPI) is a general purpose software-based toolkit that provides a library of key cryptographic modules. n Provides the ability for developers to use key cryptographic functions without the need to understand PKI n Uses common APIs, transparent to applications, multi-product support (via multi CSP support) n The CAPI SDK is freely downloadable at www. microsoft. com n No support is currently available for this toolkit 9
Entrust Toolkit n The Entrust toolkit provides the ability to add digital signatures and encryption to applications. n Provides multi-CA support n No specific client is required to sign and validate a file n Support for PEM and PKIX standards n Freely downloadable at www. entrust. com n Support available for a nominal fee 10
FIPS 140 -1, -2 Validation n Standard is defined by National Institute of Standards and Technology (NIST) n Security Level 1: a cryptographic module is not required to employ authentication mechanisms to control access to the module. It will then be required that one or more roles be implicitly or explicitly selected by the operator n Security Level 2: a cryptographic module shall employ role-based authentication to control access to the module 11
FIPS 140 -1, -2 Validation n Security Levels 3 & 4: a cryptographic module shall employ identity-based authentication mechanisms to control access to the module n FIPS 140 -1 testing ends May 25, 2002 n “After May 25, 2002, all previous validations against FIPS 140 -1 WILL STILL BE RECOGNIZED. ” 12
Questions? 13
Скачать презентацию PK-Enabling Toolkits August 27 2001 1 CSOS
f09003932fa41c7630471cb8929f46ed.ppt