Sybex CEH Certified Ethical Hacker Version 8 Study Guide

66 Chapter 3 ■ Cryptography
The CA will require a party to provide information that proves identity. Items such as
name, address, phone, physical data such as faxed records, and other records and personal
interviews might also be required as policy dictates. Once this information is obtained and
validated, the CA will issue the certificate or validate an existing certificate. A publicly
owned CA such as Thawte or VeriSign typically will perform a background check by asking
the requester to provide documentation such as a driver’s license, passport, or other
form of ID.
When a CA issues a certificate, a series of actions that you should know about takes place:
1. The request is received.
2. Background information is requested by the CA and validated.
3. The information provided by the requester is applied to the certificate.
4. The CA hashes the certificate.
5. The issuing CA signs the certificate with their private key.
6. The requester is informed that their certificate is ready for pickup.
7. The requester installs the certificate on their computer or device.
A CA is able to perform a number of roles in addition to the validation process outlined
here. Some actions that a CA is called on to perform include the following:
Generation of the Key Pair When a CA goes through the process of creating a certificate,
a key pair that is made up of a public and private key is generated. The public key is made
available to the public at large whereas the private key is given to the party requesting the
digital certificate.
Generation of Certificates The CA generates digital certificates for any authorized party
when requested. This certificate is generated after validation of the identity of the requesting
party, as mentioned earlier.
Publication of the Public Key The public key is bound to each digital certificate. Anyone
who trusts the CA or requests the public key will get the key for their use.
Validation of Certificates When a certificate is presented by one party to another it must
be validated. Since both parties involved typically do not know each other, they must rely
on a third party who is trusted; this is the role of the CA.
Revocation of Certificates If a certificate is no longer needed or trusted, it can be revoked
before it expires.
All CAs are not the same. The types of CAs are as follows:
Root CA The root CA initiates all trust paths. The root CA is the top of the food chain
and thus must be secured and protected; if its trust is called into question, all other systems
will become invalid.
Trusted Root CA A trusted root CA of a CA which is added to an application such as a
browser by the software vendor. It signifies that the application vendor trusts the CA and
assigns the entity a high level of trust.