Digital Certificates -Establish authentication

In e-commerce, authentication and secure transactions occur in two fundamental ways:

1. Public key algorithms allow relatively secure data exchange, so hackers can't sniff packets as they come across the Web.
2. Digital certificates^[1] prove a server's identity to help authentication and institute encryption.

Digital certificates are the primary means of authenticating unknown users.
Click the link below to learn more about why certificates are important.

With current technology, it is safe to say that a hacker cannot easily forge a key pair. That is, the private key cannot be easily extrapolated from a public key and used to impersonate someone else using the digital certificate. In other words, private key algorithms do a good job ensuring that no one can sniff packets. However, this procedure does not guarantee that the holder of a certificate is who he or she claims to be. Encryption does not necessarily mean authentication. You need a way to prove that the person, host, or server who has the certificate is really who or what they say they are. Properly "signed" certificates allow this to occur. Generally, an e-commerce site requires a certificate, unless it is going to use a third party.

A digital certificate involves creating a key pair, then getting the public key signed by a certificate authority^[2] (CA). There are many different ways to generate keys. IIS 4.0, for example, contains its own key generator. An e-commerce site must get its public key signed by a respected CA. CAs are to the digital world what notary publics are to the physical world: trusted third parties. A CA's job is to verify the identity of an individual or organization before endorsing a key and creating a certificate. When it is satisfied, the CA digitally signs the key using a hash algorithm and private key. Then anyone who has the CA's public key can verify the signature. Most browsers already have the public keys of most CAs. If you trust^[3] the CA, you can trust that the certificate holder is who he or she claims to be. You should note that this process simply authenticates a user, host, or site to many people. Digital certificates are not the same as digital signatures.

Digital signatures^[4] are different than digital certificates. Each of these is different than using encrypted email. It is important to differentiate among these three separate applications of public key algorithms^[5].
A digital signature involves using a special "one-way" hashing algorithm to create a hash code. This code is also called a "message digest." The message digest is then encrypted with the sender's private key, creating a complete digital signature. The recipient of the transmission must first have the sender's public key. The recipient then decrypts the information using the public key of the sender. A digital signature authenticates users. It does not encrypt information. A digital certificate, on the other hand, comprises a public key digitally signed by a trusted third party or CA. When clients visit the secure section of your e-commerce site, they will request your signed certificate, their browser will verify that it is properly signed, and the transaction will continue. The remainder of the session will be authenticated, then encrypted. Encrypting email between one party and another involves digitally signing the message, then using the recipient's public key to encrypt the signature and the symmetrically encrypted email text. The recipient then decrypts the email text using a private key.

The most widely accepted CA on the Internet is VeriSign Technology. VeriSign's digital IDs feature strong cryptographic techniques to ensure that they are not tampered with or forged. VeriSign's e-commerce grade certificates use an RSA 1024-bit key for protection. To ensure the integrity of the IDs issued by VeriSign, its facilities use comprehensive security systems, including multilevel physical access controls, biometric scanners, and sound firewall technology. If VeriSign's master CA key were ever stolen, all certificates issued by VeriSign would be compromised. As you can see, the practice of authentication using digital certificates is highly trust oriented and hierarchical; if one element is compromised, then all other elements are compromised.

Currently, VeriSign offers two types of personal certificates, Level 1 and Level 2. Levels 3 and 4 are proposed. Level 1 certificates use only email recipient verification. Level 2 certificates require additional information, such as driver's license and social security number. VeriSign checks this information for authenticity. VeriSign issues server certificates on a domain name basis. When a company registers for a server certificate, information about the company is requested. VeriSign performs a Dun & Bradstreet search on the company to verify that the information supplied is true. One additional benefit of VeriSign is insurance. VeriSign backs its certificates by varying amounts of insurance that guarantee the security of the certificate. If the certificate is forged and is used to damage the individual or organization, the insurance will reimburse up to the limit set for each individual certificate.
In the next lesson, we will introduce the concept of a public key infrastructure (PKI).

[1]Digital certificate: A way to prove your identity. You can use it to encrypt and decrypt messages from individuals and servers. In technical terms, it is a public key that has been signed by a certificate authority.

[2] Certificate authority (CA): A respected, trusted body that creates and manages certificates. A certificate authority signs other people\'s certificates and acts as a trusted third party. You can obtain personal, software publisher, server, and certificate authority certificates, depending on your needs.

[3]Trust: A trust relationship is a logical link that combines two domains into a single administrative unit. With appropriate trust relationships in place, users from a trusted domain can access resources in a trusting domain transparently.

[4]Digital signature: Use of a one-way hash algorithm and a private key to provide a stamp of approval on an electronic document or network transmission.

[5]Public key algorithm: The use of a key pair. The first half of the pair, or private key, stays secret. The second half, or public key, is freely distributed. Digital certificates and signatures use this form of algorithm.