Chapter 4 - X.509 Authentication TE-405 Network Security and Management Fall Dr. Faisal Kakar Office: Room no. 01, FICT Building

X.509 Authentication Service An International Telecommunications Union (ITU) recommendation (versus “ standard ” ) for allowing computer host or users to securely identify themselves over a network. An X.509 certificate purchased from a “ Certificate Authority ” (trusted third party) allows a merchant to give you his public key in a way that your Browser can generate a session key for a transaction, and securely send that to the merchant for use during the transaction (padlock icon on screen closes to indicate transmissions are encrypted). Once a session key is established, no one can “ high jack ” the session (for example, after your enter your credit card information, an intruder can not change the order and delivery address). User only needs a Browser that can encrypt/decrypt with the appropriate algorithm, and generate session keys from truly random numbers. Merchant ’ s Certificate is available to the public, only the secret key must be protected. Certificates can be cancelled if secret key is compromised.

Certificate Authority generates the “ signature ” that is added to raw “ Certificate ” MIC Hash Raw “ Certificate ” has user name, public key, expiration date,... Raw Cert. Signed Cert. 3 Generate hash code of Raw Certificate Encrypt hash code with CA ’ s private key to form CA ’ s signature Signed Certificate Recipient can verify signature using CA ’ s public key. CA ’ s Secure Area

4

This Certificate belongs to: investing.schwab.com trading subnet a 1199 Charles Schwab & Co., Inc. Phoenix, Arizona, US This Certificate was issued by Secure Server Certification Authority RSA Data Security, Inc. US Serial Number: 6B:68:2F:3B:FD:8A:46:73:04:33:10:8A:32:1E:47:5B This Certificate is valid from Wed Nov 03, 1999 to Thu Nov 02, 2000 Certificate Fingerprint: 4B:80:C6:C5:2D:63:14:E7:6F:50:BD:16:39:3C:96:FD 5 Information Provided by Browser about a Certificate

Are you sure that you want to delete this Site Certificate? This Certificate belongs to: endor.mcom.com Netscape Communications Corp. US This Certificate was issued by: rootca.netscape.com Information Systems Netscape Communications Corporation US Serial Number: 01:77 This Certificate is valid from Thu May 15, 1997 to Tue Nov 11, 1997 Certificate Fingerprint: 06:BF:60:88:D9:E7:59:BF:3A:35:74:33:28:8E:26:F6 6 Certificates Can Be Deleted (and Added)

X.509 Chain of Authentication CA > = CA {A ’ s id and information} X > = certificate of A “ signed ” by X To authenticate X >, you must get the public key of X from a trusted source, such as Z - your own CA. ( Z >) Z in turn may have to get X ’ s certificate from a higher level CA. Ultimately there must be an “ Authentication Tree ” of CA ’ s so that a user can work up the tree (from Z) and back down to the issuer of the certificate in question, X. 7

X.509 Chain of Authentication 8 In practice, there is no single top-level Certificate Authority (CA), only a group of CA ’ s that each Browser vendor deems fit to include in the installation program.

9 “ Root ” Certificate Authorities in Firefox (2010) added by user

Safari Browser - Google Safe Browsing Service Firefox Browser - OCSP