CYS406 · Chapter 9 · Annotated SlidesKey Distribution and Management
Original
Overview

Key Distribution and Management

Key management and its protocols, key hierarchies (master and session keys), symmetric key distribution with a KDC and its MITM risk, hybrid schemes, distributing public keys (announcement, directory, authority, certificates), X.509 certificates and CA hierarchies, revocation (CRL, OCSP) and PKI.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 48 slides
  1. 1 Slide 1
  2. 2 Key Management
  3. 3 Key Management Protocols Classification
  4. 4 Key Management is a Fundamental Issue
  5. 5 Key Management and Distribution
  6. 6 Key Distribution
  7. 7 Key Distribution
  8. 8 Key Distribution Task
  9. 9 Key Hierarchy
  10. 10 Key Hierarchy
  11. 11 Key Distribution Scenario
  12. 12 Key Distribution Issues
  13. 13 Symmetric Key Distribution Using Public Keys
  14. 14 Simple Secret Key Distribution
  15. 15 Man-in-the-Middle Attack
  16. 16 Secret Key Distribution with Confidentiality and Authentication
  17. 17 Hybrid Key Distribution
  18. 18 Distribution of Public Keys
  19. 19 Public Announcement
  20. 20 Publicly Available Directory
  21. 21 Public-Key Authority
  22. 22 Public-Key Authority
  23. 23 Public-Key Certificates
  24. 24 Public-Key Certificates
  25. 25 X.509 Authentication Service
  26. 26 X.509 Certificate Use
  27. 27 X.509 Certificates
  28. 28 X.509 Certificates
  29. 29 Obtaining a Certificate
  30. 30 CA Hierarchy
  31. 31 CA Hierarchy Use
  32. 32 Certificate Revocation
  33. 33 X.509 Version 3
  34. 34 Certificate Extensions
  35. 35 Public Key Infrastructure (PKI)
  36. 36 Public Key Infrastructure
  37. 37 X.509 PKI Simple Model
  38. 38 X.509 PKI Certificate Authority (CA)
  39. 39 X.509 PKI Registration Authority (RA)
  40. 40 X.509 PKI Certificate Distribution System
  41. 41 Case Study 1: WellsSecure PKI SHA-1 Hierarchy
  42. 42 Case Study 2: WellsSecure PKI SHA-2 Hierarchy
  43. 43 Certificate Revocation List (CRL)
  44. 44 Online Certificate Status Protocol (OCSP)
  45. 45 CRL vs OCSP Server
  46. 46 Case Study 3: Verify Certificates
  47. 47 X.509 PKI-enabled Applications
  48. 48 Summary
Slide 1 / 48

Slide 1

Slide 1: Slide 1
Slide 2 / 48

Key Management

Slide 2: Key Management
Slide 3 / 48

Key Management Protocols Classification

Slide 3: Key Management Protocols Classification
Slide 4 / 48

Key Management is a Fundamental Issue

Slide 4: Key Management is a Fundamental Issue
Slide 5 / 48

Key Management and Distribution

Slide 5: Key Management and Distribution
Slide 6 / 48

Key Distribution

Slide 6: Key Distribution
Slide 7 / 48

Key Distribution

Slide 7: Key Distribution
Slide 8 / 48

Key Distribution Task

Slide 8: Key Distribution Task
Slide 9 / 48

Key Hierarchy

Slide 9: Key Hierarchy

Notes

  1. Key hierarchy: long-term master keys (shared with the KDC) protect short-lived session keys.

Exam angle

PredictionQ1

Keys used for a single communication session and then discarded are:

Slide 10 / 48

Key Hierarchy

Slide 10: Key Hierarchy
Slide 11 / 48

Key Distribution Scenario

Slide 11: Key Distribution Scenario

Notes

  1. KDC (Key Distribution Center): a trusted third party that creates session keys and sends them encrypted with each user’s master key.

Slide 12 / 48

Key Distribution Issues

Slide 12: Key Distribution Issues
Slide 13 / 48

Symmetric Key Distribution Using Public Keys

Slide 13: Symmetric Key Distribution Using Public Keys
Slide 14 / 48

Simple Secret Key Distribution

Slide 14: Simple Secret Key Distribution

Notes

  1. Merkle’s simple scheme (A sends a public key, B returns a secret key encrypted with it) is open to man-in-the-middle.

Slide 15 / 48

Man-in-the-Middle Attack

Slide 15: Man-in-the-Middle Attack
Slide 16 / 48

Secret Key Distribution with Confidentiality and Authentication

Slide 16: Secret Key Distribution with Confidentiality and Authentication
Slide 17 / 48

Hybrid Key Distribution

Slide 17: Hybrid Key Distribution
Slide 18 / 48

Distribution of Public Keys

Slide 18: Distribution of Public Keys
Slide 19 / 48

Public Announcement

Slide 19: Public Announcement
Slide 20 / 48

Publicly Available Directory

Slide 20: Publicly Available Directory
Slide 21 / 48

Public-Key Authority

Slide 21: Public-Key Authority
Slide 22 / 48

Public-Key Authority

Slide 22: Public-Key Authority
Slide 23 / 48

Public-Key Certificates

Slide 23: Public-Key Certificates

Exam angle

PredictionQ1

A digital certificate binds:

Slide 24 / 48

Public-Key Certificates

Slide 24: Public-Key Certificates
Slide 25 / 48

X.509 Authentication Service

Slide 25: X.509 Authentication Service
Slide 26 / 48

X.509 Certificate Use

Slide 26: X.509 Certificate Use
Slide 27 / 48

X.509 Certificates

Slide 27: X.509 Certificates
Slide 28 / 48

X.509 Certificates

Slide 28: X.509 Certificates
Slide 29 / 48

Obtaining a Certificate

Slide 29: Obtaining a Certificate
Slide 30 / 48

CA Hierarchy

Slide 30: CA Hierarchy

Notes

  1. CA hierarchy: root CA → intermediate CAs → end entities; trust flows down a certificate chain.

Slide 31 / 48

CA Hierarchy Use

Slide 31: CA Hierarchy Use
Slide 32 / 48

Certificate Revocation

Slide 32: Certificate Revocation

Notes

  1. Revocation: compromised key, changed affiliation, superseded. Checked with CRLs or OCSP.

Slide 33 / 48

X.509 Version 3

Slide 33: X.509 Version 3
Slide 34 / 48

Certificate Extensions

Slide 34: Certificate Extensions
Slide 35 / 48

Public Key Infrastructure (PKI)

Slide 35: Public Key Infrastructure (PKI)

Notes

  1. PKI: the hardware, software, people, policies and procedures to create, manage, distribute, use, store and revoke certificates. Parts: CA, RA, repository, end entities.

Exam angle

PredictionQ1

The PKI component that verifies a requester’s identity before the CA issues a certificate is the:

Slide 36 / 48

Public Key Infrastructure

Slide 36: Public Key Infrastructure
Slide 37 / 48

X.509 PKI Simple Model

Slide 37: X.509 PKI Simple Model
Slide 38 / 48

X.509 PKI Certificate Authority (CA)

Slide 38: X.509 PKI Certificate Authority (CA)
Slide 39 / 48

X.509 PKI Registration Authority (RA)

Slide 39: X.509 PKI Registration Authority (RA)
Slide 40 / 48

X.509 PKI Certificate Distribution System

Slide 40: X.509 PKI Certificate Distribution System
Slide 41 / 48

Case Study 1: WellsSecure PKI SHA-1 Hierarchy

Slide 41: Case Study 1: WellsSecure PKI SHA-1 Hierarchy
Slide 42 / 48

Case Study 2: WellsSecure PKI SHA-2 Hierarchy

Slide 42: Case Study 2: WellsSecure PKI SHA-2 Hierarchy
Slide 43 / 48

Certificate Revocation List (CRL)

Slide 43: Certificate Revocation List (CRL)

Notes

  1. CRL: a periodically published, signed list of revoked serial numbers.

Slide 44 / 48

Online Certificate Status Protocol (OCSP)

Slide 44: Online Certificate Status Protocol (OCSP)

Notes

  1. OCSP: ask a responder in real time about ONE certificate (good / revoked / unknown).

Exam angle

PredictionQ1

Which checks a certificate’s revocation status in real time?

Slide 45 / 48

CRL vs OCSP Server

Slide 45: CRL vs OCSP Server
Slide 46 / 48

Case Study 3: Verify Certificates

Slide 46: Case Study 3: Verify Certificates
Slide 47 / 48

X.509 PKI-enabled Applications

Slide 47: X.509 PKI-enabled Applications
Slide 48 / 48

Summary

Slide 48: Summary