ZyXEL Communications ZYWALL 5 - L04. What Are the Main Elements of a PKI

ZyWALL 5 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation.
298
documents, hand-written signatures, sealed envelopes and established trust relationships of traditional,
paper-based transactions. These features are:
Confidentiality: Ensures than only intended recipients can read files.
Data Integrity: Ensures that files cannot be changed without detection.
Authentication: Ensures that participants in an electronic transaction are who they claim to be.
Non-repudiation: Prevents participants from denying involvement in an electronic transaction.
L04. What are the main elements of a PKI?
A PKI includes:
A Certification Authority
Digital certificates
Mathematically related key pairs, each comprising a private key and a public key
These elements work within a formal structure defined by:
Certificate Policies
A Certification Practice Statement.
L05. What is a Certification Authority?
A Certification Authority is a trusted third party that verifies the identity of an applicant registering for
a digital certificate. Once a Certification Authority is satisfied as to the authenticity of an applicant's
identity, it issues that person a digital certificate binding his or her identity to a public key. (Digital
certificates are also issued to organizations and devices, but we will focus on people for the purposes
of this discussion.)
L06. What is a digital certificate?
An electronic credential that vouches for the holder's identity, a digital certificate has characteristics
similar to those of a passport – it has identifying information, is forgery-proof, and is issued by a
trusted third party. Digital certificates are published in on-line directories. Typically, a digital
certificate contains:
The user's distinguished name (a unique identifier)
The issuing Certification Authority's distinguished name
The user's public key
The validity period
The certificate's serial number
The issuing Certification Authority's digital signature is for verifying the information in the digital
certificate.