Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 507 / 554

485
Appendix B. Introduction to Public-Key
Cryptography
Public-key cryptography and related standards underlie the security features of many products such
as signed and encrypted email, single sign-on, and Secure Sockets Layer (SSL) communications. This
chapter covers the basic concepts of public-key cryptography.
•
Section B.1, “Internet Security Issues”
•
Section B.2, “Encryption and Decryption”
•
Section B.3, “Digital Signatures”
•
Section B.4, “Certificates and Authentication”
•
Section B.5, “Managing Certificates”
B.1. Internet Security Issues
All communication over the Internet uses the Transmission Control Protocol/Internet Protocol
(TCP/IP). TCP/IP allows information to be sent from one computer to another through intermediate
computers and separate networks before reaching its destination.
The great flexibility of TCP/IP has led to its worldwide acceptance as the basic Internet and intranet
communications protocol. However, since TCP/IP allows information to pass through intermediate
computers, it is possible for a third party to interfere with communications in the following ways:
•
Eavesdropping.
Information remains intact, but its privacy is compromised. For example,
someone could gather credit card numbers, record a sensitive conversation, or intercept classified
information.
•
Tampering.
Information in transit is changed or replaced and then sent to the recipient. For example,
someone could alter an order for goods or change a person's resume.
•
Impersonation.
Information passes to a person who poses as the intended recipient. Impersonation
can take two forms:
•
Spoofing.
A person can pretend to be someone else. For example, a person can pretend to have
the email address
jdoe@example.net
or a computer can falsely identify itself as a site called
www.example.net
.
•
Misrepresentation.
A person or organization can misrepresent itself. For example, a site called
www.example.net
can purport to be an on-line furniture store when it really receives credit-card
payments but never sends any goods.
Normally, the network traffic is not monitored by the cooperating computers or networks which
compose the Internet. However, many sensitive personal and business communications over the
Internet require precautions that address potential security threats. Well-established standards and
practices known as
public- key cryptography
make it relatively easy to take such precautions.
Public-key cryptography facilitates the following tasks: