untitled

Size: px

Start display at page:

Download "untitled"

せせらいちぞの
5 years ago
Views:

1 better RFID 1

2 /?? PKI PKI ) (GPKI) GtoB GPKI LGPKI GtoC -> Identrus B2B GPKI Identrus PKI 2

3 Internet-VPN PKI? HTTPS ( ) HTTPS 3

4 PKI??????? PDA/ /? RFIDPKI?? 4

5 Challenge & Response PKI PKI Challenge Challenge Challenge Challenge 5

6 e GPKI( ) LGPKI() ( ) PKI () G (GPKI) ( ) G (LGPKI) C B B B B 6

7 PKI PKI 7

8 / / Acrobat Microsoft Office XP DocuWorks Acrobat/Office XP/DocuWorks 8

9 A( ) B(+A ) C(+A/B ) A( ) B( ) C( ) 9

10 ? / Windows Windows 10

11 Active-X IEActive-X / 11

12 / QC()? IETF RFC 3039 (Qualified Certificate) RFC

13 QC()? X.509 v3 EU-directive ETSI RFC 3739 European Directive on Electronic Signature Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures IETF Standard Track 911 IC 13

14 ? / 4( IPA()? () QC (RFC ) (subjectdirectoryattributes) dateofbirth/placeofbirth/gender/countryofcitizens hip/countryofresidence 14

15 QC (certificatepolicies) 1 ID QC (biometricinformation) URI URI http/https Picture/handewritten-signature 15

16 RSA Security RSA Keon Certificate Authority tml tficate_authority.html (QC/ ) 16

17 Challenge / Response?? 17

18 ? PKI CRL?? Trust Anchor (Trust Point)?»?» CTL (Certificate Trust List)? Issuer/Subject RFC 4158: Internet X.509 Public Key Infrastructure: Certification Path Building 18

19 Issuer C=JP,O=Fuji Xerox, OU=CAs, CN=Root CA Subject C=JP,O=Fuji Xerox, OU=CAs, CN=Root CA (Root CA) Issuer C=JP,O=Fuji Xerox, OU=CAs, CN=Root CA Subject C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 1 (Interim 1) Issuer C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 1 Subject C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 2 (Interim 2) Issuer C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 2 Subject C=JP,O=Fuji Xerox, OU=DEV, CN=Ryu Inada EE EE(Ryu Inada) Issuer C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 1 Subject C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 2 CN=Interim 2 CN=Interim 1 Issuer EE C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 2 1. Issuer Subject Subject C=JP,O=Fuji Xerox, OU=DEV, CN=Ryu Inada CN=Ryu Inada CN=Interim 2 19

20 Subject Issuer C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 1 Subject C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 2 CN=Interim 2 CN=Interim 1 Issuer C=JP,O=Fuji Xerox, OU=CAs, CN= Subject C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 2 CN=Interim 2 CN=Interim 1 EE Issuer C=JP,O=Fuji Xerox, OU=CAs, CN=Interim 2 Subject C=JP,O=Fuji Xerox, OU=DEV, CN=Ryu Inada CN=Ryu Inada CN=Interim 2 basicconstraint basicconstraint isca pathlengthconstraint 20

21 basicconstraint (Root CA) (Interim 1) basicconstraint isca TRUE pathlengthconstraint (Interim 2) (Interim 3) (Interim 4) EE(Ryu Inada) (Root CA) (Interim 1) (Interim 2) (Interim 3) (Interim 4) 2000/1/1 2001/1/1 2003/1/1 2005/1/1 2006/12/31 EE(Ryu Inada) 2002/1/1 2004/1/1 2006/1/1 21

22 keyusage keyusage extendedkeyusage (X.509v3 ) iscritical TRUE 22

23 CRL(Certificate Revolation List) CRL CRL CRLDistributionPoint CRL CRL CRL 23

24 CRL CRL(thisUpdate) CRL(nextUpdate) CRL CRLDistributionPoint OCSP CRL CRL ( ) CRL CRL OCSP OCSP(OCSP) 24

25 CRL (Certificate Revocation List) OCSP CRL Distribution Point (CRLDP)! CRLDPCRL CRL! CRL» Issuing Distribution Point» CRL AIA (Authority Information Access: ) (CRL-AIA) CRL ( ) Microsoft Windows/Sun Microsystems JAVA PKI CPU? JAVA PathBuilder/Microsoft Crypto APISecurity API» IPA / Security API» SCVP 25

26 26 CRL (EE) CRL (CA) (CA) A (EE) B A (EE) A (CA) B ( CA) CRL OCSP (EE) CRL (CA) (CA) A (EE) B A (EE) A (CA) B ( CA) OCSP OCSP CRL

27 SCVP (EE) A (CA) A B ( CA) CRL (CA) A (EE) (EE) CRL B SCVP SCVP PKI 27

28 PKI Windows Crypto API(Microsoft) OpenSSL JAVA JDK/JCE UNIX OpenSSL Windows Crypto API CSP(Crypto Service Provider) IE 4.0 Third PartyCPS Microsoft Outlook Express CAPI Internet Explorer CryptoAPI Provider A Crypto Service IIS Crypto Service Provider B 28

29 JAVA/JCE JAVA Provider 1.4 /Hash /X509 Provider Provider Provider Provider Security KeyAgreement Cipher KeyStore SecretKeyFactory Signature SecureRandom KeyGenerator KeyFactory Mac MessageDigest CertificateFactory ExemptionMechanism KeyPairGenerator JDK/JCE java.security.cert JDK JCE(Java Cryptographic Extensions) Windows Third Party JCE Sun JSSE(Java Secure Socket Extensions) SSL/TLS RFC3280 CertPathBulder/CertPathValidator/CertStore 3 CertPathBulder CertPathValidator CertStore 29

30 OpenSSL UNIX Linux/*BSD* Windows Apache SSL/TLS Apache 1.X+mod_ssl+OpenSSL Apache 1.X+Apache_SSL+OpenSSL Apache 2.X(SSL/TLS ( ) ITU-T Recommendation X.509 ISO/IEC : Information technology - Open Systems Interconnection - The Directory: Authentication framework., 1997 R. Housley, W. Ford, W. Polk, and D. Solo, RFC 2459: Internet X.509 Public Key Infrastructure Certificate and CRL Profile, M. Myers, R. Ankney, A. Malpani, S. Galperin and C. Adams, RFC 2560: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol OCSP, R. Housley, W. Polk, W. Ford, D. Solo, RFC 3280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile S. Santesson, M. Nystrom and T. Polk, RFC 3739: Internet X.509 Public Key Infrastructure: Qualified Certificates Profile M. Cooper, Y. Dzambasow, P. Hesse, S. Joseph and R. Nicholas, RFC 4158: Internet X.509 Public Key Infrastructure: Certification Path Building, T. Freeman, R. Housley, A. Malpani, D. Cooper and T. Polk, Internet Draft: Standard Certificate Validation Protocol (SCVP), ETSI TS V1.3.2 ( ) Title: Qualified Certificate profile ETSI TS V1.2.1 ( ) Title: Policy requirements for certification authorities issuing qualified certificates ETSI TS V1.1.1 ( ) Title: Electronic Signatures and Infrastructures (ESI);Policy requirements for Certification Service Providers issuing attribute certificates usable with Qualified certificates 30

31 () IPA, PKI, IPA/JNSA, API, IPA/JNSA, GPKI, PKI, ISBN ,, 2004, 255p,, ISBN X,, 2005, 575p,, PKI, ISBN ,, 2001, 233p Microsoft MS Windows Windows 2000 Windows NT Windows XP Windows Internet Explorer Outlook Outlook Express Microsoft Corporation Sun Microsystems SunJava Solaris Java JDK Sun Microsystems 31

32 32

untitled

untitled PKI 1 / SSL/TLS PKI 28 Oct 2005 PKI /JNSA PKI Day 3 PKI? 2 RFC 2459/RFC 3280/RFC 3280bis CRL(RFC 2459/RFC 3280/RFC 3280bis) OCSP(RFC 2560/Light-weight OCSP) SCVP(SCVP) CMP(RFC 2510/RFC 4210) CRMF(RFC 2511/RFC