Flashcards on Digital Signatures, PKI, and Cryptographic Protocols
Digital Signatures, PKI, & Cryptographic Protocols Explained
Tap to flip · Swipe to navigate
Public Key Infrastructure
35 cards
Card 1
Question: What is a Public Key Infrastructure (PKI) trust model mentioned in the content that uses cross-certification between authorities?
Answer: Cross-certification trust model.
Card 2
Question: What is the hierarchical trust model in PKI intended to represent?
Answer: A hierarchy of certification authorities where trust flows from root CA down through subordinate CAs.
Card 3
Question: If a user's private key is compromised, what immediate action should be taken?
Answer: Request revocation as soon as possible.
Card 4
Question: Besides revocation, what should a user do after their private key is compromised?
Answer: Potentially inform all possible relying parties and obtain a new key-pair and certificate.
Card 5
Question: What should be done if a CA's private key is compromised?
Answer: Inform all relying parties because it is a serious threat to business and trust; consider recovery options.
Card 6
Question: Why is protection of CA root keys critical, and what measures are suggested?
Answer: Because compromise undermines trust; protect root keys in safes and bunkers and keep them encrypted for most of their lifetime.
Card 7
Question: What cryptographic technique is suggested for recovering an encrypted CA root key without a single point of failure?
Answer: Threshold cryptography (t of n), where t < n shareholders must participate to recover the secret.
Card 8
Question: What does a timestamp in PKI guarantee?
Answer: A timestamp guarantees the existence of data at a specified time and can provide timeliness in crypto protocols.
Card 9
Question: How is timestamping typically implemented in PKI contexts?
Answer: Typically by combining a digital signature with reliable clock information.
Card 10
Question: What operational issue must be considered with timestamping and why?
Answer: Clock synchronization issues, because attacks can exploit incorrect or manipulated clock information.