day07 PKI

PKI

1. Overview of PKI

• Name: Public Key Infrastructure
• Function: Ensuring information security through encryption technology and digital signature
• Composition: public key encryption technology, digital certificate, CA, RA

2. Three elements of information security

• Confidentiality, integrity, non-repudiation of identity verification / operation

3. Which IT fields use PKI

• SSL/HTTPS
• IPsecVPN
• Partial remote access VPN

4. Public key encryption technology

• Role: to achieve security guarantees such as information encryption and digital signatures

• Encryption Algorithm:

  1. Symmetric encryption algorithm

     The encryption and decryption keys are consistent

  2. Asymmetric encryption algorithm

     The two parties to the communication each generate a pair of public and private keys

     Both parties exchange public keys

     The public key and private key are mutually encrypted and decrypted!

     Public and private keys cannot be pushed back against each other!

     RSA DH

  3. HASH algorithm: MD5 SHA (irreversible, verify integrity)

5. Digital signature

• The ciphertext obtained by encrypting the digest with your own private key is a digital signature

6. Certificate

• The certificate is used to guarantee the legitimacy of the public key

• The certificate format follows the X.509 standard

• Digital certificate protection information:

  User's public key value

  User identification information (such as name and email address)

  Validity period (validity of certificate)

  Issuer identification information

  Issuer's digital signature

• The digital certificate is issued by a fair and authoritative third-party organization, CA

PKI experiment

Experimental steps;

1. Configure the server IP address 10.1.1.2/24

2. Install the IIS service and establish a site.

   Verify access to http://www.flower.com on the xp client

3. Install CA components

4. Open IIS, first generate certificate application file

5. Apply for certificate from CA:

   Open the web page: http: //10.1.1.2.certsrv and send the web server application file to CA

6. CA issues a certificate

7. Download and complete the installation on the web server

8. Enable SSL443 on the web server

9. Verify on the client