SECURING FIBRE CHANNEL FABRICS - Brocade

Modes of OperationRSAAt around the same time Diffie and Hellman were completing theirwork on public key cryptography, three researchers at MIT were alsoworking independently on the same problem. Ronald Rivest, AdiShamir, and Leonard Adelman found a practical implementation of thepublic key cryptography algorithm and published their findings in 1977.They obtained a patent for their discovery and subsequently formed acompany in 1982 bearing the first initial of their last names: RSA.Their patent expired in September 2000 and is now in the publicdomain. The RSA algorithm is so widespread that it has become a defacto standard.Digital CertificatesA digital certificate is sometimes confused with a digital signature butit is very different. A digital certificate is the equivalent of an ID cardand is issued to an individual (or device) by a trusted certificationauthority (CA). It is composed of the owner's name, a serial number, anexpiration date, a copy of the owner's public key, and the digital signatureof the CA. Some digital certificates use the standardized X.509format defined in RFC 2459.Starting in FOS 4.2, Brocade switches came pre-loaded with a digitalcertificate. Digital certificates are no longer pre-loaded (since therelease of FOS 5.1), but one can still be installed, although it needs tobe acquired from a source outside Brocade. The digital certificate wasoriginally implemented to authenticate switches joining a secured fabricusing the Switch Connection Control (SCC) policy.PKIThe Public Key Infrastructure (PKI) is a set of programs, hardware,data formats, procedures, and policies required to manage digital certificates.It is a general concept with different implementations offeredby multiple vendors. PKI emerged from the necessity to provide asecure means of exchanging information and performing commercialtransactions over the Internet. The challenge was to ensure that digitalcertificates used in commercial transactions were authentic. Toaccomplish this, it was necessary to build a “web of trust” and providethe necessary authorities to attest to the validity of a digital certificate.Figure 32 illustrates the PKI scheme and its components.At the heart of the PKI is the certification authority (CA) or trusted thirdparty(TTP) that generates and distributes the digital certificate. Part ofthe digital certificate includes a digital signature from the CA attestingto the validity of the digital certificate.Securing Fibre Channel Fabrics 85