Wireless Security.pdf - PDF Archive

Security Defined 227
to provide security for our applications? The most common use of the digital signature
for authentication is a part of a digital certifi cate . A digital certificate consists of three
primary sections: information about the owner (such as real or company name, Internet
address, and physical address), the owner’s public-key, and the digital signature of that
data (including the public-key) created using the owner’s private key. Digital certificates
are typically encoded using a language called ASN.1 (Abstract Syntax Notation),
developed by the telecommunications industry in the late 1970s, and more specifically, a
subset of that language called Distinguished Encoding Rules (DER). This language was
designed to be flexible, allowing for any number of extensions to the certificate format,
which are created and used by some users of digital certificates to provide additional
information, such as which web browsers should be able to accept the certificate. The
public-key is stored using a base-64 encoding.
A digital certificate is provided by sending an application at the start of a secure
communication. The receiving application parses the certificate, decrypts the digital
signature, hashes the information, and compares it to the decrypted signature hash. If the
hashes do not match, then the certificate has been corrupted in transit or is a counterfeit.
If the hashes do match, then the application does a second check against a field in the data
section of the certificate called the Common Name (CN) . The common name represents
the Internet address (url or IP address) of the sending application. If the common name
and the address of the sending application do not match, then the receiving application can
signal a warning to the user. Finally, a valid date range can be assigned to the certificate by
the owner that will tell the recipient whether the certificate should be trusted at a certain
time. If the current date (today) is between the initial date and the expiration date indicated
in the certificate, then the certificate is considered valid (this does not supersede the other
checks). Note that all these checks are up to the receiving application; the recipient of
a digital certificate can choose to ignore all checks, or only perform one or two, but the
guarantee of security is obviously not as strong if any failed checks are ignored. The digital
certificate provides a useful mechanism for authentication, assuming that the public-key
in the certificate can be trusted. This leaves us with a problem, however. If we only get the
public-key as part of the digital certificate, how can we be certain that the person who sent
the certificate is who they say they are? It turns out that this is a very difficult problem to
solve, for many reasons. We will look at those reasons and the most common solution to
the problem in use today, the Public-Key Infrastructure (PKI) .
www.newnespress.com