Public Key Infrastructure, Digital Certificates and Digital Signatures

1
Public Key Infrastructure, Digital Certificates
and Digital Signatures
Washington stateDigital Government Applications
2
Certificate ?
Digital Signature ?
Subscriber ?
Private Key ?
Public Key ?
Certification Authority ?
PKI ?
3
How Can You Get the Best of Both Worlds?
4
Some Things Just Dont Change...
5
Identification vs. Authentication
Identification
I am John Smith
Authentication
Or...
Says who? How do they know?
6
The need for Credentials
In our paper-based world, we have paper-based
credentials
Who Says? Where Accepted
U.S. Government Worldwide
State of Washington United States
Costco Corp. Any Costco Store
7
An electronic credential used to authenticate
parties in an electronic transaction that
a) Identifies the owner b) Identifies the
practices and procedures (policy) used to issue
the certificate c) Is signed by the entity
vouching for a) and b)
8
Whom Can You Trust?

• Responsible for managing certificates and keys in
  a secure, trustworthy manner
• Can be trusted by all parties in a transaction,
  even though all parties may not be known by each
  other
• Can reliably vouch for the identity of each party
  in a transaction

9
Primary Responsibilities of the Certification
Authority
To operate a secure system (PKI) Create digital
certificates that securely bind the identity of a
person to their Public and Private Keys
10
How is a Certificate Created?
Public Key is presented to CA for insertion into
Certificate
Keys Generated by Browser, Hardware or Client
Software
Bob
11
Establishing Trust in Electronic Commerce
Three parties to every digitally authenticated
transaction...
12
PKI - How it Works Together
13
Two primary ways the technology can be used...
Support for Digital Signatures
Authentication for Access Control
14
Benefits of Digital Signatures
Data cannot be altered once it is signed (data
integrity)
You can know who provided what data
(non-repudiation)
15
Certificates Used for Digital Signatures
Name Address
16
Benefits of Digital Certificates
Provide proof of identity for authentication to
secure applications
17
Access Control - Today
USER I.D. Password
18
Access Control - Digital Government Style
19
Access Control - Digital Government Style
20
Where Do You Want to Go Today?