# Presentation: 803212

## PKI Certificates — What are they? How do I get and use them?

- James A. Rome
- Oak Ridge National Laboratory
- jar@ornl.gov
- http://www.epm.ornl.gov/~jar

- 20th DoE Computer Security Group Training Conference
- April 27, 1998

## Certificate functions

- Strong authentication
- An external authority vouches for your “identity.”
- It contains the public key of the certificate holder that allows another entity to encrypt messages that only the certificate holder can decrypt.
- It is the foundation of privacy and security on the Internet.
- electronic commerce
- encrypted transmissions

## My VeriSign certificate

## Public and private keys

- Keys are the two parts of a mathematical operation that is easy to do if you know both parts, but computationally intensive to crack if you only know one.
- Prime factors of large (1024 bit) polynomials
- Discrete logarithms
- The details are unimportant, but the two numbers become your
- public key - available to the world
- private key - ***known only to you and kept securely***

## How do you get keys and certificates?

- Keys are generated on your PC because the private key should never leave your possession.
- Can be done by a Web browser or an application program such as PGP, SSH,....
- To get a certificate for your browser, visit the Web site of a Certificate Authority (CA) and apply for a certificate. You might have to
- submit proof of identity
- pay a fee
- appear in person

## Getting a certificate

- Each CA package uses its own user interface

## Applyingfor acertificate

## Gettingthecertificate

- It is a good idea
- to save a copy of the certificate when Netscape gives you that option.

## What’s in a certificate?

- The Subject Name (Distinguished Name, or DN) contains the information that distinguishes the user’s “identity.”
- It also contains the holder’s public key.
- The certificate is signed by the CA with its private key.
- The DN info isavailable to theWeb server

## Digital signatures

- With your certificate and keys, you can create a digital signature. This allows you to:
- Sign documents to assure that they were not forged
- Make a secure hash of a document to ensure that it was not changed
- Encrypt a document to ensure privacy

## Commerce on the internet

- Present E-commerce uses site certificates and SSL (secure sockets layer) to provide encryption.
- You visit a Web site and wish to make a purchase. What needs to be known?
- Is the site really LL Bean, or an imposter?
- Will the transaction be encrypted so that your credit card is secure?
- You identity is implicit because if the credit card is accepted, the merchant is protected.

## Unsecure site (http://...)

## Secure site (https://....)

## Secure site’s certificate

- This site processes secure orders for Readmedotdoc.com

**Online Certificate Status Protocol**

- OCSP makes it possible for the Netscape 6 Personal Security Manager to perform an online check of a certificate's validity each time the certificate is viewed or used.

## E-Commerce — Details

- Look for the key or lock in Netscape.
- Examine the site’s certificate.
- Your browser uses the site’s public key to encrypt a symmetric session key and sends it to the server.
- The server decrypts the symmetric session key (with its private key) and uses it to create the SSL encrypted session.
- When you transmit your data, it is secure (if you trust the host company).

## What does a CA guarantee?

- There are different classes of certificates.
- Commercial certificates cost money (~$300 up) and require lots of proof —Dunn & Bradstreet report, Letter from company president,...
- VeriSign provides insurance for fraud losses
- Personal certificates are free or cheap ($10/year) and bind an identity to an E-mail address. VeriSign gives $1000 insurance.
- Site-issued certificates may be more appropriate for labs. (cost is $1 to $157).

## What can I do with my certificate?

- Netscape Communicator supports S/MIME E-mail

## Default S/MIME settings

## S/MIME E-mail

## S/MIME E-mail

## Certificates also verify downloads

## How do I find a person’s certificate?

- If you want to send encrypted information to someone, you need to have a copy of their public key which is contained in their certificate.
- Certificate Directories act like telephone books, but store people’s certificates
- X.500 directory
- Light-weight directory assistance protocol (LDAP)
*Which John Smith do you really mean?*

## LDAP vs Certificate Server

- Certificates can be obtained by querying either server, so why LDAP?
- LDAP contains more information so that (maybe) you can pin down John Smith.
- Phone number, FAX number, home address, title,...
- LDAP can be modified by the user to keep his information up to date.
- LDAP is often used by an organization to maintain all employee data.

## LDAP interface

## Accessing an LDAP in Netscape

- You can import a new LDAP server into Netscape:
- For my LDAP, access the following URL:
- ldap://mmc.epm.ornl.gov:389/o%3DMaterials%20Microcharacterization%20Collaboratory%2C%20c%3DUS
- The complicated argument specifies the LDAP root hierarchy.
- All MMC DNs have C=US, O=Materials Microcharacterization Collaboratory
- Your browser should pop up a window asking whether to accept this LDAP server. Answer yes.

## You can obtain a certificate from the LDAP

- from inside the Netscape security window.
- Only query by E-mail address is allowed.

## You can also formulate

- more complicated
- queries using Netscape’s
- Messenger.
- In the *Edit* Menu, select
*Search Directory*.

## New PKI applications are coming

- Eudora now supports Entrust certificates.
- SET (secure electronic transaction) technology from MasterCard/Visa will enhance e-commerce
- The merchant never sees your credit information
- Both you and the merchant deal with MC/Visa as an intermediary

## Other kinds of certificates

- SPKI (simple public key infrastructure) certificates bind a public key to an authority.
- So, to run an online facility, you need certificates that attest that:
- You have taken and passed training
- You have paid for a session
- You have a reservation for the time slot
- Your data is proprietary
- See my talk on Wednesday for details...