| Certificate Authority |
Article Index for Certificate |
Shopping Authority |
Website Links For Certificate |
Information AboutCertificate Authority |
| CATEGORIES ABOUT CERTIFICATE AUTHORITY | |
| key management | |
|
There are many commercial CAs that charge for their services. Institutions and governments may have their own CAs, and there are free CAs. ISSUING A CERTIFICATE A CA will issue a Public Key Certificate which states that the CA attests that the Public Key contained in the certificate belongs to the person, organization, server, or other entity noted in the certificate. A CA's obligation in such schemes is to verify an applicant's credentials, so that users ( Relying Parties ) can trust the information in the CA's certificates. The usual idea is that if the user trusts the CA and can verify the CA's signature, then they can also verify that a certain public key does indeed belong to whoever is identified in the certificate. If the CA can be subverted, then the security of the system breaks down. For example, suppose an attacker, Mallory, manages to get a certificate authority to issue a false certificate tying Alice to the wrong public key, which corresponding private key is known to Mallory. If Bob subsequently obtains and uses the public key in this certificate, the security of his communications could be compromised by Mallory — for example, his messages could be decrypted, or he could be tricked into accepting forged signatures. SECURITY The problem of assuring correctness of match between data and entity when the data are presented to the CA (perhaps over an electronic network), and when the credentials of the person/company/program asking for a certificate is likewise presented, is difficult, which is why commercial CAs often use a combination of authentication techniques including leveraging government bureaus, the payment infrastructure, third parties databases and services, and custom heuristics. In some enterprise systems, local forms of authentication such as s has been to "prevent conflicting and overly burdensome local regulation and to establish that electronic writings satisfy the traditional requirements associated with paper documents." Further the E-Sign and UETA code help ensure that:
In large-scale deployments Alice may not be familiar with Bob's certificate authority (perhaps they each have a different CA), so Bob's certificate may also include his CA's public key signed by a different CA2, which is presumably recognizable by Alice. This process typically leads to a hierarchy or mesh of CAs and CA certificates. SEE ALSO EXTERNAL LINKS |
|
|