Introduction to Public Key Infrastructures Johannes A. Buchmann • Evangelos Karatsiolis Alexander Wiesmaier Introduction to Public Key Infrastructures 123 Johannes A. Buchmann Evangelos Karatsiolis FB Informatik FlexSecure GmbH TU Darmstadt Darmstadt Darmstadt Germany Germany Alexander Wiesmaier AGT International Darmstadt Germany ISBN 978-3-642-40656-0 ISBN 978-3-642-40657-7 (eBook) DOI 10.1007/978-3-642-40657-7 Springer Heidelberg New York Dordrecht London Library of Congress Control Number: 2013954524 © Springer-Verlag Berlin Heidelberg 2013 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Exempted from this legal reservation are brief excerpts in connection with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher’s location, in its current version, and permission for use must always be obtained from Springer. Permissions for use may be obtained through RightsLink at the Copyright Clearance Center. Violations are liable to prosecution under the respective Copyright Law. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. Printed on acid-free paper Springer is part of Springer Science+Business Media (www.springer.com) Preface More than 30 years ago, when the Internet was emerging, public key cryptography was invented. Traditionally, cryptography relied on the exchange of secret keys prior to any secure communication, which made the application of cryptography in open networks such as the Internet very difficult. In contrast, public key cryptography allows for secure communication of entities that had no prior contact. Today, as the Internet has over two billion participants, this is extremely important. In addition, public key cryptography enables techniques that have no analogue in traditional cryptography, most importantly digital signatures. In fact, security on the Internet could not be achieved without digital signatures as they are, for example, required to authenticate software downloads and updates. We are convinced that today and in the future, there is and will be no IT security without public key cryptography. Although public key cryptography does not rely on the exchange of secret keys, proper key management is still of vital importance to its security. In public key cryptography, pairs of private and public keys are used. The first task of such key management is to keep private keys private. This is easier than protecting keys in traditional secret key cryptography as there is no need to exchange private keys over insecure channels. But it is still an important challenge since there are billions of computing devices with private keys stored on them. The second task is to guarantee the authenticity of public keys, which is as important as maintaining the secrecy of private keys. For example, if the public signature verification key of a software vendor could be replaced by the public key of an adversary, the software signatures would be of no use since the adversary would be able to sign software in the name of the software vendor. In order to fully understand public key cryptography, we therefore consider it necessary to study the infrastructures that manage key pairs in public key cryptography, the so-called public key infrastructures (PKIs). It is not sufficient to understand the ingenious mathematical mechanisms that underlie public key cryp- tography. This book grew out of a PKI course at Technische Universität Darmstadt, Germany, which we have been teaching for several years and which complements the introductory course on cryptography. It is our goal to cover the important concepts underlying PKI and to discuss relevant standards, implementations, and v vi Preface applications. We have included several exercises in each chapter that help deepen the understanding of its content. The book can thus be used as the basis for a course on PKI and as a self-study book for students and others interested in PKI. Only basic computer science knowledge is required. By giving numerous references that point to the relevant standards and implementation guidelines, we hope to make the book useful for those who are involved in PKI projects. While writing this book and working on PKI projects, it became clear to us that PKI is still a very important research and development area. While public key cryptography applications that do not require user interaction are widely used (e.g., code signing), security solutions that require users to be actively involved are not so widespread (e.g., email signature and encryption). Many say that this is because current PKI concepts are still too complicated. Also, in the recent past, several incidents have shown that PKI does not always deliver the required security. Therefore, PKI concepts are required that overcome these deficiencies. We also intend this book to aid researchers and developers in doing so. We would not have been able to write this book without the help of many people, in particular the students who attended the PKI course that the book is based on. Johannes Braun, Martin A. Gagliotti Vigil, Patrick Schmidt, Marcus Lippert, and Ciaran Mullan helped develop the exercises and made many important comments. We also thank Ronan Nugent and Alfred Hofmann of Springer for their support. Darmstadt, Germany Johannes A. Buchmann July 2013 Evangelos Karatsiolis Alexander Wiesmaier Contents 1ThePurposeofPKI........................................................ 1 1.1 TheInternet........................................................... 1 1.2 SecurityGoals........................................................ 2 1.2.1 Confidentiality .............................................. 2 1.2.2 Integrity..................................................... 3 1.2.3 Entity Authentication ....................................... 3 1.2.4 DataAuthenticity........................................... 4 1.2.5 Non-repudiation ............................................ 5 1.2.6 OtherSecurityGoals ....................................... 5 1.3 Cryptography......................................................... 5 1.3.1 SecretKeyEncryption...................................... 5 1.3.2 PublicKeyEncryption ..................................... 7 1.3.3 TheRSAPublicKeyCryptosystem ....................... 8 1.3.4 OtherPublicKeyCryptosystems .......................... 9 1.3.5 HybridEncryption.......................................... 10 1.3.6 Cryptographic Hash Functions and Message AuthenticationCodes....................................... 11 1.3.7 DigitalSignatures........................................... 12 1.3.8 TheRSASignatureScheme................................ 13 1.3.9 OtherDigitalSignatureSchemes.......................... 14 1.4 WhyPublicKeyInfrastructure?..................................... 15 1.5 Identity-Based Public Key Cryptography ........................... 16 1.6 ObjectIdentifiers..................................................... 17 1.7 Exercises.............................................................. 17 References.................................................................... 18 2 Certificates .................................................................. 21 2.1 TheConceptofa Certificate......................................... 21 2.2 X.509Certificates .................................................... 22 2.2.1 Structure..................................................... 22 2.2.2 tbsCertificate................................................ 24 vii viii Contents 2.2.3 signatureAlgorithm......................................... 27 2.2.4 signatureValue.............................................. 27 2.3 X.509CertificateExtensions ........................................ 27 2.4 AttributeCertificates................................................. 31 2.5 CVCertificates ....................................................... 31 2.6 PGPCertificates...................................................... 33 2.7 OtherCertificates..................................................... 33 2.7.1 WAPCertificates............................................ 34 2.7.2 SPKICertificates ........................................... 34 2.7.3 Traceable Anonymous Certificate ......................... 35 2.8 Exercises.............................................................. 35 References.................................................................... 37 3TrustModels...............................................................