Security

Ask something
Discussion Locked

VPN question

0 helpful
1 reply

by samgaffer

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I'm new to VPNs and I was wondering about the security of private keys. If a ca private key is stolen, then it can be used to issue CA certificates that could not be told apart from non-forged ones. Or can they? Isn't there a unique number for eachprivate key that it passes to it's issued certificates? If not there should be. What other ways are there to figure forged certificates? Dates of issue maybe? That would seem to be very time consuming. I'd appreciate any help.

1 reply

by kima

An excellent book for you will be "Implementing Virtual Private Networks by Steven Brown"

Here is a quotation from the book on the process pg. 360:

The public key, the user's unique piece of identification, and a particular CA identification forms the unsigned certificate. Next the certificate authority needs to sign this info. This is accomplished as follows: The certificate authority creates a hash code of this unsinged certificate. Then the CA takes this hash code and, together withits own private key, it encrypts them both. The CA then attaches this signature to the original certificate to form the signed certificate. Now a user could give this certificate to anyone who neds it or attach it to his or her public key.

For the recipient to verify this, he or she decrypts the signature with the certificate authority, public key to recover the original hash code. Then the user recalculates the hash code of the unsigned signature, along with the one recovered from the first step. If these two match, the recipient can be sure the certificate does indeed match the original sender. This process happens the first time during communications or at an expiration date or if the sender revokes the first step.

Hope this helps...

This discussion is closed to new replies.