Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 783 / 840

Certificates and Authentication
Appendix J Introduction to Public-Key Cryptography 783
S/MIME also makes it possible to encrypt email messages. This is also important for some
business users. However, using encryption for email requires careful planning. If the
recipient of encrypted email messages loses his or her private key and does not have access
to a backup copy of the key, for example, the encrypted messages can never be decrypted.
Form Signing
Many kinds of e-commerce require the ability to provide persistent proof that someone has
authorized a transaction. Although SSL provides transient client authentication for the
duration of an SSL connection, it does not provide persistent authentication for transactions
that may occur during that connection. S/MIME provides persistent authentication for
email, but e-commerce often involves filling in a form on a web page rather than sending an
email.
The Red Hat technology known as form signing addresses the need for persistent
authentication of financial transactions. Form signing allows a user to associate a digital
signature with web-based data generated as the result of a transaction, such as a purchase
order or other financial document. The private key associated with either a client SSL
certificate or an S/MIME certificate may be used for this purpose.
When a user clicks the Submit button on a web-based form that supports form signing, a
dialog box appears that displays the exact text to be signed. The form designer can either
specify the certificate that should be used or allow the user to select a certificate from
among the client SSL and S/MIME certificates that are installed in Communicator. When
the user clicks OK, the text is signed, and both the text and the digital signature are
submitted to the server. The server can then use a Red Hat utility called the Signature
Verification Tool to validate the digital signature.
For more information about support for form signing in Red Hat products, see Red Hat
Form Signing.
Single Sign-On
Network users are frequently required to remember multiple passwords for the various
services they use. For example, a user might have to type a different password to log into
the network, collect email, use directory services, use the corporate calendar program, and
access various servers. Multiple passwords are an ongoing headache for both users and
system administrators. Users have difficulty keeping track of different passwords, tend to
choose poor ones, and tend to write them down in obvious places. Administrators must keep
track of a separate password database on each server and deal with potential security
problems related to the fact that passwords are sent over the network routinely and
frequently.
Solving this problem requires some way for a user to log in once, using a single password,
and get authenticated access to all network resources that user is authorized to use—without
sending any passwords over the network. This capability is known as
single sign-on.