22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

What is the X.509 standard<br />

Originally, the primary intent for the X.509 standard was to specify a means to do<br />

certificate-based authentication against an X.500 directory. Directory<br />

authentication in X.509 can be done using either secret-key techniques or<br />

public-key techniques. The latter is based on public-key certificates.<br />

At present, the public-key certificate format defined in the X.509 standard is<br />

widely used and supported by a number of protocols in the Internet world. The<br />

X.509 standard does not specify a particular cryptographic algorithm, although it<br />

appears that the RSA algorithm is the one that’s most broadly used.<br />

A brief history of X.509 certificates<br />

The Internet Privacy Enhanced Mail (PEM) RFCs, published in 1993, include<br />

specifications for a public key infrastructure based on X.509 v1 certificates (see<br />

RFC 1422 for details).<br />

The experience gained in attempts to deploy RFC 1422 made it clear that the v1<br />

and v2 certificate formats were deficient in several respects. Most importantly,<br />

more fields were needed to carry required and necessary information. In<br />

response to these new requirements, ISO/IEC/ITU and ANSI X9 developed the<br />

X.509 version 3 (v3) certificate format. The v3 format extends the v2 format by<br />

providing for additional extension fields.<br />

These fields grant more flexibility because they can convey supplemental<br />

information, beyond just the key and name binding. In June 1996,<br />

standardization of the basic v3 format was completed.<br />

The contents of an X.509 certificate<br />

An X.509 certificate consists of the following fields:<br />

► Version of the certificate<br />

► Certificate serial number<br />

► Digital signature algorithm identifier (for issuer's digital signature)<br />

► Issuer (that is, the CA) name<br />

► Validity period<br />

► Subject (user or server) name<br />

► Subject public-key information: algorithm identifier and public-key value<br />

► Issuer unique identifier - version 2 and 3 only (added by version 2)<br />

► Subject unique identifier - version 2 and 3 only (added by version 2)<br />

► Extensions - version 3 only (added by version 3)<br />

► Digital signature by issuer on the above fields<br />

Chapter 6. Public key infrastructures 237

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!