Table Of Content

Deploying a Public Key Infrastructure HeinzJohner,SeieiFujiwara,AmeliaSmYeung,AnthonyStephanou,JimWhitmore InternationalTechnicalSupportOrganization www.redbooks.ibm.com SG24-5512-00 SG24-5512-00 International Technical Support Organization Deploying a Public Key Infrastructure February 2000 Take Note! Beforeusingthisinformationandtheproduct itsupports, besuretoreadthegeneralinformationin AppendixB,“Specialnotices”onpage217. FirstEdition(February2000) ThiseditionappliestoRelease3.1oftheIBMSecureWayTrustAuthorityproduct. Thisdocumentcreatedor updatedonFebruary29, 2000. Commentsmaybeaddressedto: IBMCorporation, International TechnicalSupportOrganization Dept.JN9B Building003InternalZip2834 11400Burnet Road Austin, Texas78758-3493 WhenyousendinformationtoIBM, yougrantIBManon-exclusiverighttouseor distributethe informationinanywayitbelievesappropriatewithout incurringanyobligationtoyou. ©CopyrightInternationalBusinessMachinesCorporation2000. Allrightsreserved. NotetoU.SGovernmentUsers–Documentationrelatedtorestrictedrights–Use,duplicationordisclosureis subjecttorestrictionssetforthinGSAADPScheduleContractwithIBMCorp. Contents Figures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .ix Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xi Theteamthatwrotethisredbook. ...... ....... ...... ....... ...... ...xi Comments welcome..... ...... ...... ....... ...... ....... ...... ..xiii Part 1. PKI overview and deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 Chapter 1. Introduction to security systems . . . . . . . . . . . . . . . . . . . . .3 1.1 Recap: Security basics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3 1.2 Secret key versus public key cryptography. . . . . . . . . . . . . . . . . . . . . .5 1.2.1 Secret key cryptography. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5 1.2.2 Public key cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7 1.3 Basic elements of public key cryptography. . . . . . . . . . . . . . . . . . . . . .9 1.3.1 Keys. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9 1.3.2 Digital signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10 1.3.3 Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12 1.3.4 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14 1.4 Public key and the supporting infrastructure. . . . . . . . . . . . . . . . . . . .15 1.4.1 The secure environment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 1.4.2 Business processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17 1.5 Current use of Public Key Infrastructures . . . . . . . . . . . . . . . . . . . . . .18 Chapter 2. PKI overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 2.1 The core PKI components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 2.1.1 End-Entity (EE). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22 2.1.2 Certificate Authority (CA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22 2.1.3 The Certificate Repository (CR) . . . . . . . . . . . . . . . . . . . . . . . . .24 2.1.4 The Registration Authority (RA) . . . . . . . . . . . . . . . . . . . . . . . . .25 2.1.5 X.509 certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25 2.2 The supporting components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29 2.2.1 Certificate Revocation Lists (CRLs) . . . . . . . . . . . . . . . . . . . . . .29 2.2.2 Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 2.2.3 Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34 2.3 The supporting infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34 2.3.1 Directory exploitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35 2.3.2 The system environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35 2.3.3 Cryptographic hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36 2.3.4 Smartcards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36 2.3.5 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37 2.3.6 Policies and processes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38 ©CopyrightIBMCorp.2000 iii Chapter 3. Principles of operation . . . . . . . . . . . . . . . . . . . . . . . . . . . .39 3.1 Data encryption and decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39 3.2 Digital signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43 3.3 Authentication using certificates. . . . . . . . . . . . . . . . . . . . . . . . . . . . .45 3.4 Non-repudiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48 3.5 Certificate validation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49 3.6 The certificate life cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51 3.6.1 Certificate generation process . . . . . . . . . . . . . . . . . . . . . . . . . .51 3.6.2 Certificate revocation process . . . . . . . . . . . . . . . . . . . . . . . . . .51 3.6.3 Certificate expiration process . . . . . . . . . . . . . . . . . . . . . . . . . . .52 3.6.4 Certificate suspension process. . . . . . . . . . . . . . . . . . . . . . . . . .52 3.7 Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52 3.8 Administration domains and hierarchies. . . . . . . . . . . . . . . . . . . . . . .54 Chapter 4. PKI deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59 4.1 Defining security policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59 4.1.1 Scope. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60 4.1.2 Trust model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60 4.1.3 Registration process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62 4.1.4 Certificate revocation process . . . . . . . . . . . . . . . . . . . . . . . . . .63 4.1.5 Certificate and key lifetimes . . . . . . . . . . . . . . . . . . . . . . . . . . . .66 4.1.6 Handling guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73 4.1.7 Centralized or individual responsibilities. . .. . . . . . . . . . . . . . . .74 4.1.8 Key management, storage, and archiving. . . . . . . . . . . . . . . . . .75 4.1.9 Legal considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78 4.2 Defining a deployment goal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79 4.2.1 Define the deployment scope . . . . . . . . . . . . . . . . . . . . . . . . . . .79 4.2.2 Define the security expectations and approaches. . . . . . . . . . . .80 4.3 Defining a deployment road map . . . . . . . . . . . . . . . . . . . . . . . . . . . .81 4.3.1 Pre-engagement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82 4.3.2 Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82 4.3.3 Planning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83 4.3.4 Prototyping, customization, and application development. . . . . .83 4.3.5 Pilot run . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83 4.3.6 Production . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84 4.3.7 Scalability considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85 4.4 The infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86 4.4.1 Server machines and cryptographic hardware . . . . . . . . . . . . . .86 4.4.2 Smartcards and readers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87 4.4.3 Physical environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88 4.4.4 Skills required. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89 4.5 Management and administration. . . . . . . . . . . . . . . . . . . . . . . . . . . . .89 4.5.1 Responsibilities (roles). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89 iv DeployingaPublicKeyInfrastructure 4.5.2 Key escrow. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92 4.5.3 Key recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93 4.5.4 Processes and procedures. . . . . . . . . . . . . . . . . . . . . . . . . . . . .94 4.6 Migration considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 4.6.1 PKI enablement of existing applications and services. . . . . . . . .95 4.6.2 Integration of current uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96 Part 2. Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99 Chapter 5. PKI-related standards . . . . . . . . . . . . . . . . . . . . . . . . . . . .101 5.1 ITU-T recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101 5.2 Internet RFCs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102 5.3 Internet Drafts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104 5.4 PKCS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106 5.5 Other standardization efforts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 Part 3. IBM products supporting a PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .109 Chapter 6. IBM SecureWay Trust Authority. . . . . . . . . . . . . . . . . . . . .111 6.1 Product overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112 6.2 The Trust Authority building blocks in detail . . . . . . . . . . . . . . . . . . .115 6.2.1 The Certificate Authority (CA). . . . . . . . . . . . . . . . . . . . . . . . . .115 6.2.2 The Registration Authority (RA) . . . . . . . . . . . . . . . . . . . . . . . .116 6.2.3 The Audit Server (AS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117 6.2.4 The TA Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118 6.2.5 The supporting components . . . . . . . . . . . . . . . . . . . . . . . . . . .118 6.3 Installation planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120 6.3.1 Server environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120 6.3.2 Client environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121 6.4 Installing Trust Authority. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122 6.4.1 Installation and basic configuration. . . . . . . . . . . . . . . . . . . . . .123 6.4.2 Installation test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126 6.4.3 Installing the RA Desktop. . . . . . . . . . . . . . . . . . . . . . . . . . . . .128 6.4.4 Installing the TA Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131 6.5 The user’s view of Trust Authority . . . . . . . . . . . . . . . . . . . . . . . . . .133 6.5.1 Using the enrollment Web page . . . . . . . . . . . . . . . . . . . . . . . .133 6.5.2 Requesting a certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136 6.5.3 Using the Trust Authority Client application . . . . . . . . . . . . . . .139 6.5.4 Handling server or device certificates. . . . . . . . . . . . . . . . . . . .140 6.6 The administrator’s view of Trust Authority. . . . . . . . . . . . . . . . . . . .145 6.7 Customizing and managing Trust Authority . . . . . . . . . . . . . . . . . . .147 6.7.1 Defining alternative TCP/IP ports . . . . . . . . . . . . . . . . . . . . . . .148 v 6.7.2 Changing certificate templates . . . . . . . . . . . . . . . . . . . . . . . . .152 6.7.3 Changing certificate enrollment forms and processes. . . . . . . .154 6.7.4 Other customization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157 6.7.5 Managing Trust Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157 6.8 Supported standards and technology . . . . . . . . . . . . . . . . . . . . . . . .162 6.8.1 Standards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 6.8.2 Technology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165 Chapter 7. Deployment scenarios for Trust Authority . . . . . . . . . . . .167 7.1 Situation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167 7.2 Background information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167 7.3 Technical details of ITRUST. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .168 7.4 Solution design issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169 7.4.1 Business operations view. . . . . . . . . . . . . . . . . . . . . . . . . . . . .169 7.4.2 Bank auditor view. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170 7.4.3 I/T operations view. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171 7.4.4 I/T systems development and maintenance view . . . . . . . . . . .171 7.4.5 Corporate legal view. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172 7.4.6 I/T security view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172 7.5 Solution design approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173 7.5.1 Electronic trust model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173 7.5.2 Fulfillment framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174 7.5.3 Deployment framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .175 7.5.4 Assurance framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .176 7.5.5 Integration framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177 7.6 Sample applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177 7.6.1 Design method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177 7.6.2 The Account Review Application. . . . . . . . . . . . . . . . . . . . . . . .178 7.6.3 The Payment Authorization Application . . . . . . . . . . . . . . . . . .183 7.7 Deployment scenario with IBM SecureWay Trust Authority . . . . . . .190 7.7.1 IBM Trust Authority within the ITRUST scenario. . . . . . . . . . . .190 7.7.2 Planning, installing, and configuring IBM Trust Authority .. . . .192 7.7.3 Customizing Trust Authority . . . . . . . . . . . . . . . . . . . . . . . . . . .196 7.7.4 Application-related considerations . . . . . . . . . . . . . . . . . . . . . .199 7.8 Special deployment considerations . . . . . . . . . . . . . . . . . . . . . . . . .201 7.8.1 CA key management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .201 7.8.2 Policy extensions within certificates . . . . . . . . . . . . . . . . . . . . .203 7.8.3 Dynamic credential validation. . . . . . . . . . . . . . . . . . . . . . . . . .203 7.8.4 Long-term storage of keys and protected documents . . . . . . . .204 7.8.5 Expanded use of directory services . . . . . . . . . . . . . . . . . . . . .205 7.8.6 Component integration and interoperability.. . . . . . . . . . . . . . .205 7.8.7 Server scalability for CA operations . . . . . . . . . . . . . . . . . . . . .206 7.8.8 Internet threats and countermeasures . . . . . . . . . . . . . . . . . . .206 vi DeployingaPublicKeyInfrastructure 7.8.9 Policies and business agreements . . . . . . . . . . . . . . . . . . . . . .207 7.9 Summary and caveats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .207 7.10 IBM Global Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .207 Part 4. Appendices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209 Appendix A. Introduction to LDAP .. ....... ...... ....... ...... . 211 A.1 Thehistory . ....... ...... ...... ....... ...... ....... ...... . 211 A.2 Protocolordirectory? ...... ...... ....... ...... ....... ...... . 212 A.3 Whatis adirectory? . ...... ...... ....... ...... ....... ...... . 213 A.4 TheLDAPinformationmodel ...... ....... ...... ....... ...... . 214 A.5 MoreLDAPfeatures. ...... ...... ....... ...... ....... ...... .215 A.6 Wheretogetmoreinformation..... ....... ...... ....... ...... . 216 Appendix B. Special notices . ...... ....... ...... ....... ...... . 217 Appendix C. Related publications... ....... ...... ....... ...... . 221 C.1 IBMRedbooks ..... ...... ...... ....... ...... ....... ...... . 221 C.2 IBMRedbookscollections ........ ....... ...... ....... ...... . 221 C.3 Otherresources .... ...... ...... ....... ...... ....... ...... .221 C.4 ReferencedWebsites ..... ...... ....... ...... ....... ...... . 222 How to get IBM Redbooks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 IBMRedbooksfax orderform ... ...... ....... ...... ....... ...... . 226 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .227 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .229 IBM Redbooks evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .237 vii viii DeployingaPublicKeyInfrastructure

ebook img

Deploying a public key infrastructure PDF

254 Pages·2000·2.252 MB·English
by  Heinz Johner, et al
#
Save to my drive
Quick download
Download

Download Deploying a public key infrastructure PDF Free - Full Version

by Heinz Johner; et al| 2000| 254 pages| 2.252| English

Download Deploying a public key infrastructure by Heinz Johner; et al in PDF format completely FREE. No registration required, no payment needed. Get instant access to this valuable resource on PDFdrive.to!

Free Download PDF

About Deploying a public key infrastructure

No description available for this book.

Detailed Information

Author:Heinz Johner; et al
Publication Year:2000
ISBN:904354
Pages:254
Language:English
File Size:2.252
Format:PDF
Price:FREE
Download Free PDF

Safe & Secure Download - No registration required

Why Choose PDFdrive for Your Free Deploying a public key infrastructure Download?

  • 100% Free: No hidden fees or subscriptions required for one book every day.
  • No Registration: Immediate access is available without creating accounts for one book every day.
  • Safe and Secure: Clean downloads without malware or viruses
  • Multiple Formats: PDF, MOBI, Mpub,... optimized for all devices
  • Educational Resource: Supporting knowledge sharing and learning

Free Books Similar to Deploying a public key infrastructure

Frequently Asked Questions

Is it really free to download Deploying a public key infrastructure PDF?

Yes, on https://PDFdrive.to you can download Deploying a public key infrastructure by Heinz Johner; et al completely free. We don't require any payment, subscription, or registration to access this PDF file. For 3 books every day.

How can I read Deploying a public key infrastructure on my mobile device?

After downloading Deploying a public key infrastructure PDF, you can open it with any PDF reader app on your phone or tablet. We recommend using Adobe Acrobat Reader, Apple Books, or Google Play Books for the best reading experience.

Is this the full version of Deploying a public key infrastructure?

Yes, this is the complete PDF version of Deploying a public key infrastructure by Heinz Johner; et al. You will be able to read the entire content as in the printed version without missing any pages.

Is it legal to download Deploying a public key infrastructure PDF for free?

https://PDFdrive.to provides links to free educational resources available online. We do not store any files on our servers. Please be aware of copyright laws in your country before downloading.

The materials shared are intended for research, educational, and personal use in accordance with fair use principles.

We use cookies

We use cookies to ensure you get the best browsing experience on our website. By clicking "Accept Cookies", you agree that we can store cookies on your device in accordance with our Terms and Privacy.