Internet Security - Dang Thanh Binh's Page

228 INTERNET SECURITY
The key identifier field of the authority key identifier extension must be included in
all certificates generated by conforming CAs to facilitate chain building. The value of the
key identifier field should be derived from the public key used to verify the certificate’s
signature or a method that generates unique values. This field helps the correct certificate
for the next certification authority in the chain to be found.
Subject key identifier extension
The subject key identifier extension provides a means of identifying certificates that contain
a particular public key.
To facilitate chain building, this extension must appear in all conforming CA certificates
including the basic constraints extension. The value of the subject key identifier
is the value placed in the key identifier field of the authority key identifier extension of
certificates issued by the subject of the certificate.
For CA certificates, subject key identifiers should be derived from the public key or a
method that generates unique values. Two common methods for generating key identifiers
from the public key are:
• The key identifier is composed of the 160-bit SHA-1 hash value of the bit string of
the subject public key.
• The key identifier is composed of a four-bit-type field with 0100 followed by the least
significant 60 bits of the SHA-1 hash value of the bit string of the subject public key.
For end entity certificates, the subject key identifier extension provides a means of identifying
certificates containing the particular public key used in an application. For an
end entity which has obtained multiple certificates from multiple CAs, the subject key
identifier provides a mean to quickly identify the set of certificates containing a particular
public key.
Key usage extension
This extension defines the key usage for encryption, signature and certificate signing with
the key contained in the certificate. When a key which is used for more than one operation
is to be restricted, the usage restriction is required to be employed. An RSA key should be
used only for signing; the digital signature and/or non-repudiation bits would be asserted.
Likewise, when an RSA key is used only for key management, the key encryption bit
would be asserted. Bits in the key usage type are used as follows:
Key Usage :: = Bit String {
digital signature bit (0)
non-repudiation bit (1)
key encryption bit (2)
data encryption bit (3)
key certificate sign bit (4)
key agreement sign bit (5)