Basic PKI Implementation
- Alice and Bob have public key certificates issued by Ivan, the Certificate Authority (CA).
- Alice wishes to perform a transaction with Bob and sends him her public key certificate.
- Bob, concerned that Alice's private key may have been compromised, creates an 'OCSP request' that contains Alice's certificate serial number and sends it to Ivan.
- Ivan's OCSP responder reads the certificate serial number from Bob's request. The OCSP responder uses the certificate serial number to look up the revocation status of Alice's certificate. The OCSP responder looks in a CA database that Ivan maintains. In this scenario, Ivan's CA database is the only trusted location where a compromise to Alice's certificate would be recorded.
- Ivan's OCSP responder confirms that Alice's certificate is still OK, and returns a signed, successful 'OCSP response' to Bob.
- Bob cryptographically verifies Ivan's signed response. Bob has stored Ivan's public key sometime before this transaction. Bob uses Ivan's public key to verify Ivan's response.
- Bob completes the transaction with Alice.
Read more about this topic: Online Certificate Status Protocol
Famous quotes containing the word basic:
“There’s one basic rule you should remember about development charts that will save you countless hours of worry.... The fact that a child passes through a particular developmental stage is always more important than the age of that child when he or she does it. In the long run, it really doesn’t matter whether you learn to walk at ten months or fifteen months—as long as you learn how to walk.”
—Lawrence Kutner (20th century)