[Day 7] 1. Public Key Infrastructure (PKI)

Definition and Purpose:

• PKI is primarily used for authentication purposes.
• It is an ISO authentication framework that employs public-key cryptography and the X.509 standard for digital certificates.
• Root CA serves as the starting point in PKI, similar to Root DNS in the DNS hierarchy.

---

Key Components:

1. Certificate Authority (CA):

   • An entity responsible for issuing and managing digital certificates.
   • Types of CAs:
     • Internal CA: Operates within private networks (e.g., enterprises).
     • Public (External) CA: Provides certificates for public use.
   • Root CA:
     • Creates a self-signed certificate (signed by its own private key).
     • Generates a private key and a public key.
   • Sub CA:
     • Issues certificates to final recipients based on requests received from clients.

2. X.509 Standard:

   • ISO standard that defines how digital certificates are created and their contents (e.g., "Issued To," "Issued By," "Validity Period").
   • Ensures interoperability of certificates between systems.

3. Certificate Signing Request (CSR):

   • A form containing information about the entity requesting the certificate.
   • Sent to the Sub CA for certificate issuance.

4. Digital Certificate:

   • A mechanism to associate a public key with the identity of the certificate holder.
   • Created and signed (digitally) by a CA.
   • Contains:
     • Identity information.
     • Public key of the holder.
     • CA's digital signature.
   • Used by browsers to validate website authenticity using the public key.

!1. PKI.png

---

Certificate Lifecycle:

1. Issuance:

   • Root CA or Sub CA signs the certificate, binding the holder's identity to their public key.

2. Validation:

   • Browser checks if the website's certificate is issued by a trusted CA in the system's MMC (Microsoft Management Console).
   • If the CA is trusted, the website is authenticated.
   • If not, the browser displays a warning: "This website is not secure."

3. Revocation:

   • Certificate Revocation List (CRL):
     • A list of revoked certificates maintained by Sub CAs.
   • Online Certificate Status Protocol (OCSP):
     • Protocol used by browsers to check the revocation status of certificates in real-time.
   • Example:
     • If a private key is compromised (e.g., for
       Copy

       sunbeaminfo.in

       ), the Sub CA will revoke the certificate and update the CRL.

---

Entities and Functions in PKI:

1. Certificate Authorities (CA): Issue and revoke certificates.
2. Registration Authorities (RA): Verify the identity of certificate requestors.
3. Certificates: Provide public key binding with identity information.
4. Certificate Repository: Stores issued certificates.
5. Certificate Revocation System: Maintains a list of revoked certificates (CRL).
6. Keys: Public and private key pairs for encryption and decryption.
7. Timestamping: Verifies the validity of digital certificates at a specific time.
8. Client-Side Software: Interacts with certificates for authentication.
9. Users: Final recipients or entities using certificates.

---

Important Concepts:

1. Certificate Revocation and CRL:

   • Ensures that compromised or invalid certificates are no longer trusted.
   • Revoked certificates are added to a CRL maintained by Sub CA.

2. Digital Certificate Purpose:

   • Binds identity to a public key.
   • Provides secure communication and user authentication.

3. Root and Sub CA Hierarchy:

   • Root CA is the ultimate trust anchor.
   • Sub CAs handle the delegation and management of certificates.

---

Key Takeaway:

PKI ensures secure communication, user authentication, and integrity of transactions through a hierarchical structure of CAs, digital certificates, and robust revocation mechanisms.

---