Electronic Signatures within the Public Key Infrastructure

• Introduction

Students gain an overview of the basic terms of PKI, such as: certificate, certificate authority, relying party and the concepts of encryption, authentication and electronic signature.

• Cryptographic background

The concept of a cryptographic key is introduced and Kerckhoffs’ principle is explained. A brief summary is provided on cryptographic primitives necessary for understanding PKI: the basics of public key cryptography and cryptographic hash functions are explained. The RSA cryptosystem is outlined as an example for a public key cryptosystem.

• Certificate

The concepts of public key certificate and certificate policy are explained. The structure and the lifecycle of a certificate (registration, issuance, use, verification, revocation, expiration etc) are explained. It is also justified why it is not possible to have just one certificate and to use it everywhere.

• Certificate Authority (CA)

Students gain an understanding of what a certificate authority is, how it operates and what security measures it implements.

• Certification chains

Certificate authorities can be interconnected via ‘cross-certification’ that allows an end-user trusting one CA to verify and accept certificates issued by another one. Various PKI structures (hierarchical, bridged, mesh etc) are demonstrated. Possible problems and their solutions are addressed.

• Electronic signatures

The concepts of advanced electronic signature and qualified electronic signature are explained, the legal difference between them is highlighted. The processes of creating and verifying electronic signatures are demonstrated, and some widespread signature formats (e.g. PKCS#7, XMLDSIG, XAdES, CAdES) are explained. The concept of signature policy is explained.

• Visit to Microsec

A visit to Microsec premises where students meet a real certification authority. Students also receive a smart card containing public key certificates that can be used for creating qualified electronic signatures.

• Time stamping

When verifying an electronic signature, we need to know that the signature existed at a certain point of time. If such a trusted point of time is not available, verification becomes ambiguous and signatures can be easily repudiated. Time stamping is perhaps the most straightforward way of obtaining and preserving such time evidence.

• Long-term archiving of electronic signatures

If the verifiability of an electronic signature needs to be preserved for a long period of time (e.g. for 50 years), special measures must be taken.

• Encryption and partner authentication using PKI

While the public key infrastructure used for signatures, can also be used for encryption or partner authentication, it requires a fundamentally different approach. Such differences are highlighted. An even deeper insight is provided into web-based authentication using the secure socket layer (SSL) protocol, which constitutes perhaps the most widespread use of PKI.

• Certificates & roles – attribute certificates

While public key certificates can contain information on the role of the certificate holder, it is beneficial to separate the role from the public key. Attribute certificates provide a standardized solution for this.

• How can electronic signatures be used? How are they used?

While the legal framework for electronic signatures has been in place for more than ten years, there are relatively few applications yet. Case studies shall be presented on both successful and less successful applications.