Public-key Infrastructure Chương này trình bày các hồ sơ liên quan đến cơ sở hạ tầng khóa công khai (PKI) cho mạng Internet. PKI quản lý khóa công khai tự động thông qua việc sử dụng các Giấy chứng nhận khóa công khai. Nó cung cấp một cơ sở để có sức chứa interoperation giữa các thực thể PKI. Một vấn đề PKI quy mô lớn, thu hồi và quản lý giấy chứng nhận khóa công khai chữ ký số để cho phép các bên xa đáng tin cậy xác thực lẫn nhau. Một âm thanh kỹ thuật số chữ. | 6 Public-key Infrastructure This chapter presents the profiles related to public-key Infrastructure PKI for the Internet. The PKI manages public keys automatically through the use of public-key certificates. It provides a basis for accommodating interoperation between PKI entities. A large-scale PKI issues revokes and manages digital signature public-key certificates to allow distant parties to reliably authenticate each other. A sound digital signature PKI should provide the basic foundation needed for issuing any kind of public-key certificate. The PKI provides a secure binding of public keys and users. The objective is how to design an infrastructure that allows users to establish certification paths which contain more than one key. Creation of certification paths commonly called chains of trust is established by Certification Authorities CAs . A certification path is a sequence of CAs. CAs issue revoke and archive certificates. In the hierarchical model trust is delegated by a CA when it certifies a subordinate CA. Trust delegation starts at a root CA that is trusted by every node in the infrastructure. Trust is also established between any two CAs in peer relationships cross-certification . The CAs will certify a PKI entity s identity a unique name and that identity s public key. A CA performs user authentication and is responsible for keeping the user s name and the associated public key. Hence each CA must be a trusted entity at least to the extent described in the Policy Certification Authority PCA policies. The CAs will need to certify public keys create certificates distribute certificates and generate and distribute Certificate Revocation Lists CRLs . The PCA is a special purpose CA which creates a policy-setting responsibility that is how the CA s and PCA s functions and responsibilities are defined and how they interact to determine the nature of the infrastructure. Therefore PKI tasks are centred on researching and developing these functions .
