Implementing-cryptography-using-python

42 Chapter 2 ■ Cryptographic Protocols and Perfect Secrecy
and certificate handling include processes that define the certificate format, the
certificate hierarchy, and the certificate revocation lists. The three dialogues that
are provided for direct authentication include:
■■
One-way authentication: Requires synchronized clocks
■■
Two-way mutual authentication: Also requires synchronized clocks
■■
Three-way mutual authentication: Based on random numbers
NOTE Clock synchronization on a network is important to a number of technologies,
including Kerberos and X.509 certificates. The maximum tolerance for computer
clocks should be 5 minutes. This helps limit that amount of time that a replay
attack can happen. The most common way to synchronize clocks automatically is to
use the Network Time Protocol (NTP). NTP is a hierarchical protocol. The source clock
is called Stratum 1. Clocks that synchronize from the original source are called Stratum
2. Clocks that synchronize from Stratum 2 are called Stratum 3, and so on.
Public-Key Certificates
Public-key certificates essentially act as a passport that certifies that a public-key
belongs to a specific name or organization. Certificates are issued by certificate
authorities, more commonly known as CAs. One of the properties of using
public-key certificates is that they allow all users to know without question
that the public-key of the CA can be checked by each user. In addition, certificates
do not require the online participation of a TTP. One thing that you must
remember is that the security of the private key is crucial to the security of all
users. The following represents the notation of a certificate binding a public key
+KA to user A issued by a certificate authority CA using its private key -CKCA:
Cert-CKCA(+KA) = CA[V, SN, AI, CA, TCA, A, +KA] where:
V = version number
SN = serial number
AI = algorithm identifier of signature algorithm used
CA = name of certification authority
TCA = period of validity of this certificate
A = name to which the public key in this certificate is bound
+KA = public to be bound to a name
Certificate Chains and Certificate Hierarchy
Consider communication between our two users: Alice and Bob. Each user lives
geographically apart. Each user may have public keys from different CAs. For
simplicity, designate Alice’s certificate authority as CA A and Bob’s certificate