| Foreword |
|
xv | |
| Acknowledgments |
|
xvii | |
|
|
|
1 | (4) |
|
How This Book Is Organized |
|
|
2 | (2) |
|
|
|
3 | (1) |
|
|
|
3 | (1) |
|
|
|
3 | (1) |
|
The Standard Applications |
|
|
4 | (1) |
|
|
|
4 | (1) |
|
Adding Value to PKI in the Future |
|
|
4 | (1) |
|
|
|
4 | (1) |
|
Who Should Read This Book |
|
|
4 | (1) |
|
|
|
5 | (12) |
|
|
|
6 | (3) |
|
Symmetric Integrity Functions |
|
|
9 | (1) |
|
Asymmetric Key Management |
|
|
10 | (2) |
|
|
|
12 | (5) |
|
|
|
17 | (12) |
|
|
|
18 | (3) |
|
|
|
18 | (1) |
|
|
|
19 | (2) |
|
|
|
21 | (1) |
|
|
|
21 | (2) |
|
Certificate Revocation List |
|
|
23 | (2) |
|
|
|
25 | (1) |
|
|
|
26 | (1) |
|
|
|
27 | (2) |
|
Authentication Mechanisms |
|
|
29 | (14) |
|
|
|
30 | (1) |
|
One-Time Authentication Values |
|
|
31 | (3) |
|
Challenge/Response Authentication |
|
|
32 | (1) |
|
Time-Based Implicit Challenge |
|
|
33 | (1) |
|
Using One-Way Hash Functions |
|
|
33 | (1) |
|
|
|
34 | (5) |
|
Obtaining a Ticket-Granting Ticket |
|
|
35 | (2) |
|
Authenticating to a Server |
|
|
37 | (1) |
|
Kerberos Public Key Initialization |
|
|
38 | (1) |
|
Certificate-Based Authentication |
|
|
39 | (4) |
|
|
|
43 | (10) |
|
Infrastructure Components |
|
|
44 | (6) |
|
|
|
44 | (1) |
|
|
|
44 | (2) |
|
Maintaining Status Information and Issuing CRLs |
|
|
46 | (1) |
|
Publishing Certificates and CRLs |
|
|
46 | (1) |
|
|
|
47 | (1) |
|
Delegating Responsibility |
|
|
47 | (1) |
|
|
|
48 | (1) |
|
|
|
49 | (1) |
|
|
|
49 | (1) |
|
|
|
50 | (1) |
|
|
|
50 | (1) |
|
|
|
50 | (1) |
|
|
|
51 | (2) |
|
|
|
53 | (16) |
|
|
|
54 | (3) |
|
|
|
54 | (1) |
|
|
|
55 | (2) |
|
Enterprise PKI Architectures |
|
|
57 | (3) |
|
|
|
57 | (1) |
|
|
|
58 | (2) |
|
|
|
60 | (7) |
|
Extended Trust List Architecture |
|
|
61 | (1) |
|
Cross-Certified Enterprise PKIs |
|
|
62 | (2) |
|
|
|
64 | (3) |
|
Choosing the Best Architecture |
|
|
67 | (2) |
|
X.509 Public Key Certificates |
|
|
69 | (38) |
|
X.509 Certificate Evolution |
|
|
70 | (1) |
|
|
|
70 | (4) |
|
|
|
70 | (1) |
|
|
|
71 | (1) |
|
|
|
71 | (1) |
|
|
|
72 | (1) |
|
|
|
73 | (1) |
|
|
|
74 | (1) |
|
|
|
74 | (24) |
|
The Tamper-Evident Envelope |
|
|
75 | (1) |
|
Basic Certificate Content |
|
|
76 | (3) |
|
|
|
79 | (1) |
|
|
|
80 | (1) |
|
|
|
80 | (1) |
|
|
|
81 | (1) |
|
|
|
82 | (1) |
|
|
|
82 | (1) |
|
|
|
82 | (3) |
|
|
|
85 | (1) |
|
|
|
85 | (1) |
|
|
|
86 | (1) |
|
|
|
87 | (1) |
|
|
|
87 | (1) |
|
|
|
88 | (1) |
|
|
|
89 | (1) |
|
|
|
89 | (2) |
|
|
|
91 | (2) |
|
|
|
93 | (1) |
|
|
|
94 | (1) |
|
|
|
94 | (1) |
|
|
|
95 | (1) |
|
|
|
96 | (1) |
|
Authority Information Access |
|
|
96 | (1) |
|
Subject Information Access |
|
|
97 | (1) |
|
Subject Directory Attributes |
|
|
98 | (1) |
|
Generating and Using Certificates |
|
|
98 | (9) |
|
|
|
99 | (1) |
|
|
|
99 | (1) |
|
|
|
100 | (1) |
|
|
|
101 | (1) |
|
CA Certificates within an Enterprise PKI |
|
|
101 | (1) |
|
CA Certificates between Enterprise PKIs |
|
|
102 | (1) |
|
CA Certificates in a Bridge CA Environment |
|
|
103 | (1) |
|
|
|
103 | (1) |
|
Trust Point Establishment |
|
|
103 | (1) |
|
|
|
104 | (1) |
|
|
|
104 | (1) |
|
|
|
104 | (1) |
|
Policy Rollover Certificates |
|
|
105 | (1) |
|
|
|
105 | (1) |
|
|
|
105 | (2) |
|
Certificate Revocation Lists |
|
|
107 | (18) |
|
|
|
107 | (11) |
|
The Signed Certificate List |
|
|
109 | (2) |
|
|
|
111 | (1) |
|
|
|
111 | (1) |
|
|
|
112 | (1) |
|
|
|
112 | (1) |
|
|
|
113 | (1) |
|
Issuing Distribution Point |
|
|
114 | (1) |
|
|
|
115 | (1) |
|
|
|
115 | (1) |
|
|
|
116 | (1) |
|
|
|
116 | (1) |
|
|
|
117 | (1) |
|
|
|
118 | (1) |
|
Generating and Using CRLs |
|
|
118 | (7) |
|
|
|
118 | (1) |
|
|
|
119 | (1) |
|
|
|
120 | (1) |
|
|
|
120 | (1) |
|
|
|
121 | (1) |
|
|
|
122 | (1) |
|
|
|
123 | (2) |
|
|
|
125 | (12) |
|
|
|
126 | (1) |
|
Common Repository Protocols |
|
|
127 | (6) |
|
|
|
127 | (1) |
|
|
|
128 | (2) |
|
Lightweight Directory Access Protocol (v2) |
|
|
130 | (1) |
|
X.500 Directory with LDAP |
|
|
130 | (1) |
|
|
|
131 | (1) |
|
|
|
131 | (1) |
|
|
|
132 | (1) |
|
|
|
132 | (1) |
|
Domain Name System Support |
|
|
133 | (1) |
|
|
|
133 | (1) |
|
Practical PKI Repositories |
|
|
134 | (3) |
|
Building and Validating Certification Paths |
|
|
137 | (18) |
|
Certification Path Construction |
|
|
138 | (6) |
|
|
|
138 | (1) |
|
Hierarchical PKI Architectures |
|
|
138 | (1) |
|
|
|
139 | (1) |
|
Extended Trust List Architectures |
|
|
140 | (1) |
|
Cross-Certified PKI Architectures |
|
|
141 | (1) |
|
|
|
142 | (2) |
|
Certification Path Validation |
|
|
144 | (7) |
|
|
|
145 | (2) |
|
Basic Certificate Checking |
|
|
147 | (1) |
|
Preparation for the Next Certificate |
|
|
148 | (2) |
|
|
|
150 | (1) |
|
|
|
151 | (3) |
|
|
|
152 | (1) |
|
|
|
153 | (1) |
|
Merging Path Construction and Validation |
|
|
154 | (1) |
|
|
|
154 | (1) |
|
|
|
155 | (26) |
|
PKI Management Transactions |
|
|
156 | (1) |
|
|
|
156 | (1) |
|
|
|
157 | (5) |
|
Management Protocol Comparison Criteria |
|
|
162 | (1) |
|
Common PKI Management Protocols |
|
|
163 | (16) |
|
|
|
164 | (1) |
|
|
|
165 | (1) |
|
PKCS #10 and SSL Summary |
|
|
166 | (1) |
|
PKCS #7 and PKCS #10 |
|
|
167 | (2) |
|
PKCS #7 and #10 Summary |
|
|
169 | (1) |
|
Certificate Management Protocol (CMP) |
|
|
170 | (4) |
|
|
|
174 | (1) |
|
Certificate Management using CMS (CMC) |
|
|
175 | (1) |
|
|
|
176 | (1) |
|
Simple Certificate Enrollment Protocol (SCEP) |
|
|
177 | (1) |
|
|
|
178 | (1) |
|
Selecting PKI Management Protocols |
|
|
179 | (2) |
|
Policies, Procedures, and PKI |
|
|
181 | (18) |
|
Introduction to Policy and Procedures |
|
|
182 | (1) |
|
|
|
183 | (13) |
|
Certificate Policies and Certification Practice Statements |
|
|
184 | (1) |
|
The CP, CPS, and Policy Extensions |
|
|
185 | (3) |
|
CP and CPS Format and Contents |
|
|
188 | (1) |
|
Highlights of the RFC 2527 Format |
|
|
189 | (1) |
|
|
|
189 | (1) |
|
|
|
189 | (2) |
|
Identification and Authentication |
|
|
191 | (1) |
|
|
|
191 | (1) |
|
Physical, Procedural, and Personnel Security Controls |
|
|
192 | (1) |
|
Technical Security Controls |
|
|
193 | (1) |
|
Certificate and CRL Profiles |
|
|
194 | (1) |
|
Specification Administration |
|
|
195 | (1) |
|
Compliance Audits and Accreditation |
|
|
195 | (1) |
|
Advice for Policy Authors |
|
|
196 | (3) |
|
|
|
199 | (20) |
|
|
|
200 | (6) |
|
Message Signature and Encryption |
|
|
201 | (1) |
|
Enhanced Security Services |
|
|
202 | (2) |
|
|
|
204 | (2) |
|
Transport Layer Security (TLS) |
|
|
206 | (5) |
|
|
|
207 | (2) |
|
|
|
209 | (1) |
|
|
|
210 | (1) |
|
|
|
211 | (7) |
|
|
|
212 | (2) |
|
Authentication Header (AH) |
|
|
214 | (1) |
|
Encapsulating Security Payload |
|
|
215 | (2) |
|
Internet Key Exchange (IKE) |
|
|
217 | (1) |
|
|
|
218 | (1) |
|
|
|
218 | (1) |
|
Defense Message System 1.0 |
|
|
219 | (14) |
|
|
|
219 | (9) |
|
Cryptographic Environment |
|
|
220 | (1) |
|
|
|
220 | (2) |
|
Certificate and CRL Profiles |
|
|
222 | (3) |
|
|
|
225 | (1) |
|
|
|
225 | (2) |
|
|
|
227 | (1) |
|
|
|
227 | (1) |
|
|
|
228 | (1) |
|
Successes and Shortcomings |
|
|
228 | (3) |
|
|
|
231 | (2) |
|
California Independent Service Operator |
|
|
233 | (22) |
|
|
|
234 | (16) |
|
Cryptographic Environment |
|
|
235 | (1) |
|
|
|
236 | (5) |
|
Certificate and CRL Profiles |
|
|
241 | (5) |
|
|
|
246 | (1) |
|
|
|
246 | (2) |
|
|
|
248 | (1) |
|
|
|
249 | (1) |
|
|
|
249 | (1) |
|
Successes and Shortcomings |
|
|
250 | (2) |
|
|
|
252 | (3) |
|
The Federal Bridge CA Project |
|
|
255 | (16) |
|
|
|
256 | (12) |
|
Cryptographic Environment |
|
|
256 | (2) |
|
|
|
258 | (2) |
|
|
|
260 | (2) |
|
Certificate and CRL Profiles |
|
|
262 | (2) |
|
|
|
264 | (1) |
|
|
|
265 | (1) |
|
|
|
265 | (2) |
|
|
|
267 | (1) |
|
Successes and Shortcomings |
|
|
268 | (1) |
|
|
|
269 | (2) |
|
|
|
271 | (30) |
|
|
|
271 | (3) |
|
|
|
274 | (1) |
|
|
|
274 | (6) |
|
|
|
274 | (3) |
|
|
|
277 | (2) |
|
Alternative Certificate Formats |
|
|
279 | (1) |
|
|
|
280 | (4) |
|
On-line Certificate Status Protocol |
|
|
280 | (2) |
|
Sliding Window Delta CRLs |
|
|
282 | (2) |
|
|
|
284 | (1) |
|
Certification Path Construction and Validation |
|
|
285 | (4) |
|
Certification Path Validation Testing |
|
|
285 | (1) |
|
Delegated Certification Path Construction Services |
|
|
286 | (2) |
|
Certification Path Validation Services |
|
|
288 | (1) |
|
|
|
289 | (3) |
|
Interoperability of Heterogeneous Products |
|
|
290 | (1) |
|
|
|
290 | (1) |
|
|
|
291 | (1) |
|
|
|
291 | (1) |
|
|
|
292 | (3) |
|
|
|
293 | (1) |
|
Health Insurance Portability and Accountability Act (HIPAA) |
|
|
293 | (1) |
|
Government Paperwork Elimination Act (GPEA) |
|
|
294 | (1) |
|
European Directive 1999/93/EC |
|
|
294 | (1) |
|
|
|
295 | (4) |
|
|
|
295 | (1) |
|
ETSI Electronic Signature Format |
|
|
295 | (1) |
|
|
|
296 | (1) |
|
Wireless Application Protocol (WAP) |
|
|
296 | (2) |
|
PKI-Enabled Trusted Third-Party Services |
|
|
298 | (1) |
|
|
|
299 | (1) |
|
|
|
299 | (2) |
| Appendix A ASN.1 Primer |
|
301 | (6) |
|
|
|
302 | (2) |
|
|
|
303 | (1) |
|
|
|
303 | (1) |
|
Implicit and Explicit Tagging |
|
|
304 | (1) |
|
|
|
304 | (1) |
|
|
|
304 | (1) |
|
Distinguished Encoding Rules |
|
|
305 | (2) |
| Appendix B Object Identifiers |
|
307 | (4) |
|
|
|
308 | (1) |
|
American National Standards Institute |
|
|
308 | (1) |
|
Other National Standards Bodies |
|
|
308 | (1) |
|
Internet Assigned Numbers Authority |
|
|
309 | (1) |
|
Computer Security Objects Registry |
|
|
309 | (1) |
|
|
|
309 | (2) |
| Bibliography |
|
311 | (8) |
| Index |
|
319 | |