Apple Mac OS X Server Version 10.4 or Later Uživatelský manuál stáhnout pdf (Strana 94)

94 Appendix Certificates and Security

Public and Private Keys

Within a PKI, two digital keys are created: the public key, and the private key. The

private key isn’t meant to be distributed to anyone, and is often encrypted itself by a

passphrase. The public key, on the other hand, is distributed to other communicating

parties. Basic key capabilities can be summed up as:

Web, Mail, and Directory Services use the public key with SSL to negotiate a shared key

for the duration of the connection. For example, a Mail server will send its public key to

a connecting client and initiate negotiation for a secure connection. The connecting

client uses the public key to encrypt a response to the negotiation. The mail server,

since it has the private key, can decrypt the response. The negotiation continues until

both the mail server and the client have a shared secret to encrypt traffic between the

two computers.

Certificates

Public keys are often contained in certificates. A user can digitally sign messages using

his private key, and another user can verify the signature using the public key

contained in signer’s certificate which was issued by a Certificate Authority (CA) within

the PKI.

A public key certificate (sometimes called an “identity certificate”) is a file in a specified

format (Mac OS X Server uses the x.509 format) which contains:

• The public key half of a public-private key pair.

• The key user’s identity information, such as a person’s name and contact information.

• A validity period (how long the certificate can be trusted to be accurate).

• The URL of someone with the power to revoke the certificate (its “revocation center”).

• The digital signature of either a CA, or the key user himself.

Key Type Capabilities

Public Keys • Can encrypt messages that can only by decrypted by the holder

of the corresponding Private key.

• Can verify the signature on a message originating as coming

from a Private key.

Private Keys • Can digitally sign a message or certificate, claiming authenticity.

• Can decrypt messages which were encrypted with the Public key.

• Can encrypt messages which can only be decrypted by the

Private key, itself.

1 2 ... 89 90 91 92 93 94 95 96 97 98 99 ... 112 113

Žádné komentáře

Apple Mac OS X Server Version 10.4 or Later Uživatelský manuál Strana 94