In the public key cryptography environment, certificates are digital documents that associate, or bind, a public key to an individual, organization, corporate position, or other entity. They allow Bob, for example, to verify Alice’s claim that a given public key does, in fact, belong to her. In their simplest form, certificates contain a public key and a name; they can also contain an expiration date, the name of the authority that issued the certificate (and, therefore, is vouching for the identity of the user), a serial number, any pertinent policies describing how the certificate was issued and/or how the certificate may be used, the digital signature of the certificate issuer, and perhaps other information.
Certificates are necessary in the cyber world since pieces of paper obviously do not exist. Digital certificates will, in fact, be the basis for the future of paperless electronic commerce and provide the mechanism for a wide range of business decisions. The specific functions of the certificate are listed below.
- Establishment of identity
- Assignment of authority: Establishing what actions the holder may or may not take, based upon this certificate
- Securing confidential information: For example, encrypting the session’s symmetric (secret) key for data confidentiality
The Value of Certificates in the VPN
A certificate is not a required component of a VPN. To create an encrypted tunnel, two endpoints need only share a secret key, which can be as simple as a password. Two network operators can talk by telephone and agree on a password for their VPN. While simple, this solution is ideal only in site-to-site VPNs between parties that can establish their identities via alternate means (e.g., telephone).
Likewise, without prior communication or exchanging certificates, two parties can establish a secure exchange of keys across an untrusted medium. Diffie-Hellman key exchange was developed for this purpose.
The value of the certificate is that it allows two parties who cannot meet face to face to verify that each side of the communication is who it says it is. Imagine a large corporation with thousands of SOHO VPN users. What better way to harvest the passwords of those users than by convincing them to connect to my server instead of the corporation’s? Certificates prevent this problem. If client software checks certificates, I could not succeed with my deception, because presumably I could not have the correct public key of the corporation.
Of course, this begs the question, How do I know the corporate certificate is real? What if I have never connected to this corporation before and, therefore, never have seen its certificate to know it changed? How can I trust it? In this case, the certificate authority (CA) proves valuable. While I might not be sure of the identity of the corporation I’m connecting to, if I trust that the CA, such as VeriSign, has verified the identity of the corporation and signed its certificate with the CA’s key, then, by extension, I should trust the corporation’s certificate.
|| tHAWT 166 What's digital certificate?|