Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 212 / 450

Private Key
The private key must be kept safely by the key owner. Accidental publication of
the private key compromises the key pair and renders it useless.
Public Key
The key owner circulates the public key for use by third parties.
17.1.1 Key Authenticity
Because the public key process is in widespread use, there are many public keys in
circulation. Successful use of this system requires that every user be sure that a public
key actually belongs to the assumed owner. The assignment of users to public keys is
confirmed by trustworthy organizations with public key certificates. Such certificates
contain the name of the key owner, the corresponding public key, and the electronic
signature of the person issuing the certificate.
Trustworthy organizations that issue and sign public key certificates are usually part
of a certification infrastructure that is also responsible for the other aspects of certificate
management, such as publication, withdrawal, and renewal of certificates. An infras-
tructure of this kind is generally referred to as a public key infrastructure or PKI. One
familiar PKI is the OpenPGP standard in which users publish their certificates them-
selves without central authorization points. These certificates become trustworthy when
signed by other parties in the “web of trust.”
The X.509 Public Key Infrastructure (PKIX) is an alternative model defined by the
IETF (Internet Engineering Task Force) that serves as a model for almost all publicly-
used PKIs today. In this model, authentication is made by certificate authorities (CA)
in a hierarchical tree structure. The root of the tree is the root CA, which certifies all
sub-CAs. The lowest level of sub-CAs issue user certificates. The user certificates are
trustworthy by certification that can be traced to the root CA.
The security of such a PKI depends on the trustworthiness of the CA certificates. To
make certification practices clear to PKI customers, the PKI operator defines a certifi-
cation practice statement (CPS) that defines the procedures for certificate management.
This should ensure that the PKI only issues trustworthy certificates.
198 Security Guide