TCP/IP Tutorial and Technical Overview - IBM Redbooks

public key and identification, a digital certificate usually contains other
information too, such as:
► Date of issue
► Expiration date
► Miscellaneous information from the issuing CA (for example, serial number)
Note: There is an international standard in place for digital certificates: The
ISO X.509 protocols.
The parties retrieve each other's digital certificate and authenticate it using the
public key of the issuing certification authority. They have confidence that the
public keys are real, because a trusted third party vouches for them. This helps
protect against both man-in-the-middle and impersonation attacks.
It is easy to imagine that one CA cannot cover all needs. What happens when
Bob's certificate is issued by a CA unknown to Alice? Can she trust that unknown
authority? Well, this is entirely her decision, but to make life easier, CAs can form
a hierarchy, often referred to as the trust chain. Each member in the chain has a
certificate signed by its superior authority. The higher the CA is in the chain, the
tighter security procedures are in place. The root CA is trusted by everyone and
its private key is top secret.
Alice can traverse the chain upward until she finds a CA that she trusts. The
traversal consists of verifying the subordinate CA's public key and identity using
the certificate issued to it by the superior CA.
When a trusted CA is found in the chain, Alice is assured that Bob's issuing CA is
trustworthy. This is all about delegation of trust. We trust your identity card if
somebody who we trust signs it. And if the signer is unknown to us, we can go
upward and see who signs for the signer, and so on.
An implementation of this concept is in the SET protocol, where the major credit
card brands operate their own CA hierarchies that converge to a common root.
Lotus® Notes® authentication, as another example, is also based on certificates,
and it can be implemented using hierarchical trust chains. PGP also uses a
similar approach, but its trust chain is based on persons and it is a distributed
Web rather than a strict hierarchical tree.
22.2.6 Random-number generators
An important component of a cryptosystem is the random-number generator.
Many times random session keys and random initialization variables (often
referred to as initialization vectors) are generated. For example, DES requires an
792 TCP/IP Tutorial and Technical Overview