• Saturday July 4, 2009 - 4:19:48 pm BST
• registered : 1501906
• online : 50125
• questions/day : 4541
• Answer rate : 75.94%

Introduction to the concept of certificates

Asymmetric encryption algorithms are based on the sharing of a public key among various users. In general, this key is shared via an electronic directory (usually in LDAP format) or a website.

However, this mode of sharing has a major shortcoming: nothing guarantees the key belongs to the user it is associated with. A hacker can corrupt the public key appearing in the directory by replacing it with his public key. As a result, the hacker will be able to decrypt all messages that have been encrypted with the key appearing in the directory.

A certificate makes it possible to associate a public key with an entity (a person, machine, etc.) to guarantee its validity. The certificate can be seen as the public key's ID card, issued by a body called a Certification Authority (often abbreviated CA).

The certification authority is responsible for issuing certificates, assigning them a validity date (similar to the expiration date on food products), and revoking certificates before this date in the event that the key (or its owner) is compromised.

Structure of certificates

Certificates are small files that are divided into two parts:

• The part containing information
• The part containing the certification authority's signature

The structure of certificates is standardized by the ITU's X.509 standard (more precisely X.509v3), which defines the information contained in the certificate:

• The version of X.509 the certificate corresponds to;
• The certificate's serial number;
• The encryption algorithm used to sign the certificate;
• The name (DN, for Distinguished Name) of the issuing certification authority;
• The certificate's starting validity date;
• The certificate's ending validity date;
• The public key's subject;
• The public key of the certificate's owner;
• The certificate issuer's signature (thumbprint).

All of this information (information + requesting party's public key) is signed by the certification authority, meaning that a hash function creates a fingerprint of this information, and then this hash is encrypted with the certification authority's private key; the public key having been widely distributed ahead of time to make it possible for users to verify certification authority's signature with its public key.

When a user wants to communicate with another person, he simply needs to obtain the recipient's certificate. This certificate contains the recipient's name and public key and is signed by the certification authority. It is therefore possible to verify the message's validity by applying, firstly, the hash function to the information contained in the certificate, and by decrypting, secondly, the certification authority's signature with its public key and comparing the two results.

Certificate signatures

There are various types of certificates depending on their signature level:

• Self-signed certificates are certificates for internal use. Signed by a local server, this type of certificate makes it possible to guarantee confidential exchanges within an organization, for the purposes of an intranet, for example. Self-signed certificates can be used to authenticate users.
• Certificates signed by a certification body are necessary when secure exchanges need to be ensured with anonymous users, for example in the case of a secure website that can be accessed by the general public. The third-party certifier guarantees the user that the certificate does indeed belong to the organization it is said to belong to.

Types of use

Certificates are mainly used in three types of contexts:

• Client certificates, stored on the user's workstation or embedded in a container such as a chip card, make it possible to identify a user and associate him with rights. In most cases, they are transmitted to the server when a connection is made, and the server assigns rights in function of the user's accreditation. They are real digital ID cards that use an asymmetric key pair ranging from 512 to 1024 bits long.
• Server certificates, installed on a web server, make it possible to connect a service with the service's owner. In the case of a website, they make it possible to guarantee that the web page's URL and particularly its domain really belong to such or such a company. They also make it possible to protect transactions with users thanks to the SSL protocol.
• VPN certificates are a type of certificate installed in network equipment that make it possible to encrypt communication flows from start to finish between two points (for example, two company sites). In this type of scenario, the users have a client certificate, the servers apply a server certificate and the communication equipment uses a special certificate (generally an IPSec certificate.