IBM WebSphere V5.0 Security - CGISecurity

If Bob wants to answer, he should use Alice‘s public key for encryption.The example above is not suitable for the encryption of large amounts of data,because public key algorithms are very slow. We use the secure key algorithmsto transmit large amounts of data. The session keys must be delivered with thepublic key algorithm and will be used during the communication.This is the concept that SSL is following to establish a secure communication.CertificatesA certificate is a document from a trusted party which proves the identity of aperson. PKI certificates work in a similar fashion; if someone has a certificatefrom a trusted party, we can make sure of his or her identity.SignaturesSignatures also work as in everyday life. Signatures used in the PKI environmentwork as follows: the information encrypted with a person’s (the sender) privatekey will be unique to this person. Anybody can decode the message, and thesource will be identified, because only one public key can open the message: thesender’s public key. This message is almost good enough to be used for a digitalsignature; the only problem is that we would like to sign documents, and anencrypted document is too long to be a signature.Signatures are not enough for identification. For example, if someone wants totravel by air, a passport will have to be shown as proof of identification.The certificate, similar to a passport, is issued by a trusted authority. It shouldcontain information about the owner and should be signed by the authority.There is a standard defining the form of a certificate, called X.509. This standardalso defines the attributes of a certificate, for example: X.500 name, issuer’sname, distinguished name, serial number, and so on...Elements of a certification authority systemA PKI system completes the tasks related to public key cryptography. Thesetasks should be separate, meaning that a PKI system should have somewell-defined units to execute the different tasks. In some cases, the PKIimplementation must separate the different functions physically (for example, in acommercial CA system). In this case , the elements listed next are located ondifferent servers.14 IBM WebSphere V5.0 Security Handbook