untitled

Size: px

Start display at page:

Download "untitled"

ゆきひらひのと
6 years ago
Views:

1 PKI 1

2 / SSL/TLS PKI 28 Oct 2005 PKI /JNSA PKI Day 3 PKI? 2

3 RFC 2459/RFC 3280/RFC 3280bis CRL(RFC 2459/RFC 3280/RFC 3280bis) OCSP(RFC 2560/Light-weight OCSP) SCVP(SCVP) CMP(RFC 2510/RFC 4210) CRMF(RFC 2511/RFC 4211) CP&CPS(RFC 2527/RFC 3647) SSL/TLS/IPsec/Secure DNS(DNS extensions) (S/MIME) SSH (Secure Shell) (LTANS) SPAM DKIM 28 Oct 2005 PKI /JNSA PKI Day 5 3

4 /CRL RFC RFC 3280Obsolete RFC RFC 3280bis ! RFC 28 Oct 2005 PKI /JNSA PKI Day 7 RFC 3280bis SHA () Qualified Certificate?? 4 28 Oct 2005 PKI /JNSA PKI Day 8 4

5 QC()? IETF RFC 3039 (Qualified Certificate) RFC Oct 2005 PKI /JNSA PKI Day 9 QC()? X.509 v3 EUdirective ETSI RFC Oct 2005 PKI /JNSA PKI Day 10 5

6 QC European Directive on Electronic Signature Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures IETFStandard Track 911 IC 28 Oct 2005 PKI /JNSA PKI Day 11 QC ETSI TS V1.3.2 ( ) Title: Qualified Certificate profile ETSI TS V1.2.1 ( ) Title: Policy requirements for certification authorities issuing qualified certificates ETSI TS V1.1.1 ( ) Title: Electronic Signatures and Infrastructures (ESI);Policy requirements for Certification Service Providers issuing attribute certificates usable with Qualified certificates RFC 3739 Internet X.509 Public Key Infrastructure: Qualified Certificates Profile 2004/3 RFC Oct 2005 PKI /JNSA PKI Day 12 6

7 ? PKI CRL?? Trust Anchor (Trust Point)?»?» CTL (Certificate Trust List)? 28 Oct 2005 PKI /JNSA PKI Day 14 7

8 CRL CRL (Certificate Revocation List) OCSP CRL Distribution Point (CRLDP)! CRLDP CRL CRL! CRL Issuing Distribution Point CRL AIA (Authority Information Access: ) (CRL-AIA) CRL 28 Oct 2005 PKI /JNSA PKI Day 15 () MicrosoftWindows PKI CPU? JAVA PathBuilder/Microsoft Crypto APISecurity API SCVP 28 Oct 2005 PKI /JNSA PKI Day 16 8

9 CRL (EE) CRL (CA) A A (CA) B (CA) A (EE) (CA) (EE) CRL B 28 Oct 2005 PKI /JNSA PKI Day 17 OCSP CRL (CA) (EE) A A (CA) B (CA) CRL A (EE) (CA) (EE) OCSP B OCSP 28 Oct 2005 PKI /JNSA PKI Day 18 9

10 SCVP (EE) A (CA) A B (CA) CRL (CA) A (EE) (EE) CRL B SCVP SCVP 28 Oct 2005 PKI /JNSA PKI Day 19 10

11 SSL/TLS S/MIME IPsec 28 Oct 2005 PKI /JNSA PKI Day 21 SSL/TLS 11/564 IETF 2-3? HTTP 1.1 Server Name Indication 28 Oct 2005 PKI /JNSA PKI Day 22 11

12 SSL/TLS 28 Oct 2005 PKI /JNSA PKI Day 23 SSL/TLS 28 Oct 2005 PKI /JNSA PKI Day 24 12

13 SSL/TLS C S S S C C 28 Oct 2005 PKI /JNSA PKI Day 25 S/MIME Ver.3.1 RFC 3850/RFC 3851/RFC 3852 AES S/MIME Capability 28 Oct 2005 PKI /JNSA PKI Day 26 13

14 S/MIME () 28 Oct 2005 PKI /JNSA PKI Day 27 (Opaque) 28 Oct 2005 PKI /JNSA PKI Day 28 14

15 (Clear) 28 Oct 2005 PKI /JNSA PKI Day 29! e 300dpi 256(1677) TIFF PDF OCR» PKI 28 Oct 2005 PKI /JNSA PKI Day 30 15

16 PKI / ( ) ( ) () ( ) () (3-10) 28 Oct 2005 PKI /JNSA PKI Day 31 RFC 3161 (TSA, Time Stamping Authority) 1ab5c98f /2/14 15:00:00 1ab5c98f... TimeStamp :00:00 TSA 28 Oct 2005 PKI /JNSA PKI Day 32 16

17 MAC XML RFC3161 ETSI TS ISO/IEC ISO/IEC ISO/IEC ISO/IEC OASIS DSSTIML ISO/IEC ISO/IEC RSA ISO/IEC TSA ETSI TS (RFC 3628) ETSI TS (RFC 3126),XAdES,DVCS,TAP 28 Oct 2005 PKI /JNSA PKI Day 33 RFC 3161 HTTP FILE SMTP Socket TCP 28 Oct 2005 PKI /JNSA PKI Day 34 17

18 28 Oct 2005 PKI /JNSA PKI Day 35 ETSI TS TSP TSP SHALL NOT) SHA-1 RIPEMD-160 MD5MAY) TSP accuracy,nonce(must) ordaring FALSE SHA-1withRSA(MUST) RSA1024bits (MUST) 2048bits (SHOULD) DSApq 1024bits (SHALL) HTTP nonce(must) accuracy 1 orderingfalse gentime 1 non-critical (SHALL) (MUST) SHA1 MD5RIPEMD160 SHA-1withRSA(MUST) RSA1024bits (MUST) 2048bits (SHOULD) TSA X.520 NameC ST O CN ST HTTP 28 Oct 2005 PKI /JNSA PKI Day 36 18

19 A A CRL A A 3 t 28 Oct 2005 PKI /JNSA PKI Day 37 TimeStamp :45:00 CRL A A A 3 TimeStamp :45: t 28 Oct 2005 PKI /JNSA PKI Day 38 19

20 (TTP) DVCS (Data Validation & Certification Protocol, RFC 3029) TAP (Trusted Archival Protocol, IETF ) RFC 3126 Electronic Signature Formats for long term electronic signatures ETSI TS ESI Electronic Signature Formats ETSI TS XML Advanced Electronic Signatures (XAdES) 28 Oct 2005 PKI /JNSA PKI Day 39 DVCS (Data Validation & Certification Protocol) cpd: Certification of Possession of Data ccpd: Certification of Claim of Possession of Data vsd: Validation of Digitally Signed Document vpkc: Validation of Public Key Certificates 28 Oct 2005 PKI /JNSA PKI Day DVCS 8. DVC 2. DVCS (cpd,ccpd,vsd,vpkc) 7. DVCS DVCS 6. Timestamp Token TSA DVC 5. Timestamp Token 20

21 TAP (Trusted Archival Protocol) () () TAP (TAA) TAP 28 Oct 2005 PKI /JNSA PKI Day 41 RFC 3126 (Electronic Signature Formats for long term electronic signatures) ES-A ES-A ES-A ES-X Time Stamp Time Stamp Time Stamp 28 Oct 2005 PKI /JNSA PKI Day 42 21

22 XAdES (ETSI TS XML Advanced Electronic Signatures) <dsig:signature Id="Sig" XA ES-A XA ES-X-L XA ES-X xmlns:dsig=" <dsig:signedinfo> : </dsig:signedinfo> <dsig:signaturevalue>...</dsig:signaturevalue> <dsig:keyinfo> : </dsig:keyinfo> <dsig:object> <XAdES:QualifyingProperties xmlns:xades=" Target="Sig"> <XAdES:SignedProperties> <XAdES:SignedSignatureProperties> <XAdES:SigningTime> </XAdES:SigningTime> XML Signature XA ES-C XA ES-T XA ES Signed Property UnSigned Property Time- Stamp Over digital SIgnature Complete Certificate And Revocation referrence Time-Stamp Over Certificate path references and revocation status referrences OR Over ds:signature element Time-Stamp in XAdES-T certificate path referrences and revocation status referrences Certificate path data and revocation status data Sequence of Time-Stamps Over XAdES-X-L <XAdES:SigningCertificate> </XAdES:SigningCertificate> <XAdES:SignaturePolicyIdentifier> </XAdES:SignaturePolicyIdentifier> <XAdES:SignatureProductioPlace> </XAdES:SignatureProductioPlace>? <XAdES:SignatureRole> </XAdES:SignatureRole>? </XAdES:SignedSignatureProperties> < XAdES:SignedDataObjectProperties> XAdES <XAdES:DataObjectFormat > </XAdES:DataObjectFormat >* <XAdES:CommitmentTypeIndication> </XAdES:CommitmentTypeIndication>* <XAdES:AllDataObjectsTimeStamp> </XAdES:AllDataObjectsTimeStamp> * <XAdES:ndividualDataObjectsTimeStamp> </XAdes:AllDataObjectsTimeStamp>* </XAdES:SignedDataObjectProperties> </XAdES:SignedProperties> <XAdES:UnsignedProperties> <XAdES:UnsignedDataObjectProperties> <XAdES:UnsignedDataObjectPropertiy> <esign:accepttimestamp xmlns:esign= > </esign:accepttimestamp> </XAdES:UnsignedDataObjectProperty> <XAdES:UnsignedDataObjectProperties> <XAdES:UnsignedSignatureProperties> <XAdES:CounterSignature> </XAdES:CounterSignature>* <XAdES:SignatureTimeStamp> </XAdES:SignatureTimeStamp>+ XAdES-T <XAdES:CompleteCertificateRefs> </XAdES:CompleteCertificateRefs> <XAdES:CompleteRevocationRefs> </XAdES:CompleteRevocationRefs> XAdES-C (<XAdES:SigAndRefsTimeStamp> </XAdES:SigAndRefsTimeStamp>* <XAdES:RefsOnlyTimeStamp> </XAdES:RefsOnlyTimeStamp>*) <XAdES:CertificateValue> </XAdES:CertificateValue> <XAdES:RevocationValue> </XAdES:RevocationValue> <XAdES:ArchiveTimeStamp> </XAdES:ArchiveTimeStamp>+ </XAdES:UnsignedSignatureProperties> </XAdES:UnsignedProperties> </XAdES:QualifyingProperties> </dsig:object> </dsig:signature> XAdES-X XAdES-X-L XAdES-A 28 Oct 2005 PKI /JNSA PKI Day TSA (long-term archive) 28 Oct 2005 PKI /JNSA PKI Day 44 22

23 ETSI IETFLTANS-WG Adobe? 28 Oct 2005 PKI /JNSA PKI Day 45 IPsec IKEv1/ISAKMP IKEv2 IETF pki4ipsec WG 28 Oct 2005 PKI /JNSA PKI Day 46 23

24 Secure DNS DNS DHCPDynamic Update SPAM 28 Oct 2005 PKI /JNSA PKI Day 47 Microsoft MS Windows Windows 2000 Windows NT Windows XP WindowsInternet Explorer Outlook Outlook ExpressMicrosoft Corporation Sun Microsystems SunJava Solaris Java JDKSun Microsystems 28 Oct 2005 PKI /JNSA PKI Day 48 24

25 25

untitled

untitled 1 2 1 3 IR... 4 2 5 1990 Surety 1990 2000 IETFISO/IEC 6 3 7 ISO/IEC 18014 IETF RFC 3161 Time-stamp Protocol ETSI TS 102 023RFC 3628) ETSI TS 101 861 8 4 (TSA, Time Stamping Authority) 1ab5c98f... 1ab5c98f...