former SIO Pondicherry - Informatics

S PECIAL FEATUREM Manivannan, NIC-A&N (former SIO Pondicherry)AS.KVenkatesan,Roy and MonaSIO PondicherryAsnani,NIC HQPONDICHERRY NIC Certifying Authority-Setting Ensuring an a Example Secure E-Future“ The first step towards an Information Societyrequires that millions of people be entrustedwith information considered sensitive or evensecret”-S.Frederic StarrThe above quote implicitly considers thatsecret information be protected to maintainits secrecy ! But the very openness of theInternet, that has led to its explosive growth,has also given rise to security limitations.Government entities and private businessesthat are obvious candidates for participatingin electronic commerce are understandablycautious. To be able to rely on the electronicmessages they receive, such organizationsneed assurance that those messages areauthentic and reliable.Digital communication has created newcomplications for old business models:? How do you know the identity of theperson you’re dealing with?? How do you prove that a certaintransaction was performed ?? How do you secure your communication?By implementing a public key infrastructure(PKI), entities can be assured that dataremains confidential and intact, and alltransactions are legally binding.?| NIC Certifying Authority (NICCA)As the Government of India moves towardthe implementation of E-Governance atvarious levels of Government functioning,authentication of information becomes acritical requirement. To provide thenecessary platform, a Public KeyInfrastructure becomes essential. NIC hasset up a Certifying Authority, which is anintegral part of this Public KeyInfrastructure.PKI refers to a whole host of components,applications, policies and practices which areresponsible for offering its users thefollowing benefits:? Certainty of the quality of informationsent and received electronically? Certainty of the source and destinationof that information? Assurance of the time and timing of thatinformation? Certainty of the privacy of thatinformation? Assurance that the information may beintroduced as evidence in a court of lawPKI ModelUser deviceor server1. User appliesfor certificate155. RA sendscertificate toend userto user2. RA approvesrequest, sendsto CAThe basic components of a PKI are theRegistration Authority (RA) and theCertifying Authority (CA). The RAauthenticates and registers new users andrequests certificates for them. The CAgenerates certificates on the RA’s requestand posts the certificate to a directory. APKI also includes policies, procedures, andcontracts that govern how and when digitalcertificates are issued, renewed, or revoked,among other issues.Therefore, public key infrastructure consistsof :? A certifying authority (CA) that issuesand verifies Digital Signature Certificate.? A registration authority (RA) that acts asthe verifier for the certificate authoritybefore a digital certificate is issued to arequestor23Registrationauthority (RA)3. CA issuescertificate4CertificateAuthority (CA)4. CA postscertificate todirectoryCertificateDirectory? One or more directories where thecertificates (with their public keys) areheld? A certificate management systemA Certifying Authority (CA) is a trusted thirdparty or an entity that has been grantedlicense by the Controller of CertifyingAuthorities (CCA), the apex regulatory bodyfor Certifying Authorities in the country, tovalidate identities and issue DigitalSignature Certificates. The method ofvalidating identities, issuing of certificates,certificate management etc depends on thepolicies of CA as defined and published intheir Certificate Practice Statement (CPS).NICCA fulfills requirements oftrustworthiness of a Certifying Authority aslaid down by the IT Act2000.?| A certificate-based system providesservices commonly known as ‘CAIN’ :? Confidentiality- to ensure that sensitiveinformation does not fall into the wronghands? Authentication- to verify the identity ofthe sender and the recipient of digitalinformation? Integrity- to verify that information isreceived unaltered from the sender? Non-repudiation- to ensure thattransactions are legally binding,protecting your business from fraud?| How Public Key Cryptography Works :The method of disguising plain text in sucha way to hide its substance is calledEncryption. Encrypting plain text results inunreadable gibberish called Ciphertext. Theprocess of reverting ciphertext to its originalplain text is called Decryption.?| In public key cryptography :? A public and private key (called as keypair), are created by a CertifyingAuthority (CA) in the presence of thesubscriber or alternately this key pair maybe generated by subscriber himself.? The private key is given only to therequesting party. The private key isnever shared with anyone or sent acrossthe Internet.? The public key is made publicly available(as part of a digital certificate) in a06October 2003