Front cover - IBM Redbooks

the place of that person. Thus, the signing component (machine, code, and so
forth) must be trusted.
Given the general security of the signing device (that is, the user’s computer) and
the practice of putting keys in escrow (where they are available, technically, to
the administrators and managers of the organization), digital signatures have
proven to have little legal value in a court of law. Thus, the trust in digital
signatures, at this time, should be balanced with an understanding of their
fallibility in matters of complete and absolute non-repudiation.
1.4.6 Public key certificates
We have seen how public key cryptography overcomes the problem of having to
pass a secret from sender to receiver. There is still a need to send a key, but now
it is a public key, that anyone can see because it is only useful to an attacker if he
also has the private key. However, this overlooks one crucial element of trust:
how can you be sure that the public key really came from who you think it came
from?
One answer is to only pass public keys to someone you know. Bob and Alice
have known each other for a long time (in fact, people have started to talk), so
they could share their public keys by exchanging diskettes. For normal cases,
however, you need some way to be sure that a public key is authentic.
The mechanism for doing this is the public key certificate. This is a data structure
containing a public key, plus details of the owner of the key, all digitally signed by
some trusted third party. Now when Alice wants to send Bob her public key she
actually sends a certificate. Bob receives the certificate and checks the
signature. As long as it has been signed by a certifier that he trusts, he can
accept that this really is Alice's key.
Certificates in real life are more complex than this. Descriptions of how they are
used in a variety of ways are in the detailed sections about SSL and Notes
security later in this Redbook.
1.4.7 Public key cryptographic standard
All these cryptographic tools and techniques are not much good without a set of
related, agreed-upon, standards to provide the basis for interoperability. These
are called Public Key Cryptographic Standards (PKCS).
PKCS is the set of informal inter-vendor standards developed in 1991 by RSA
Laboratories with representatives of Apple, Digital, Lotus, Microsoft, MIT,
Northern Telecom, Novell, and Sun. Since its publication in June 1991, PKCS
Chapter 1. Fundamentals of IT security 39