Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 511 / 554

Certificates and Authentication
489
Figure B.3. Using a Digital Signature to Validate Data Integrity
Figure B.3, “Using a Digital Signature to Validate Data Integrity”
shows two items transferred to
the recipient of some signed data: the original data and the digital signature, which is a one-way
hash of the original data encrypted with the signer's private key. To validate the integrity of the data,
the receiving software first uses the public key to decrypt the hash. It then uses the same hashing
algorithm that generated the original hash to generate a new one-way hash of the same data.
(Information about the hashing algorithm used is sent with the digital signature.) Finally, the receiving
software compares the new hash against the original hash. If the two hashes match, the data has not
changed since it was signed. If they do not match, the data may have been tampered with since it was
signed, or the signature may have been created with a private key that does not correspond to the
public key presented by the signer.
If the two hashes match, the recipient can be certain that the public key used to decrypt the digital
signature corresponds to the private key used to create the digital signature. Confirming the identity of
the signer also requires some way of confirming that the public key belongs to a particular entity. For
more information on authenticating users, see
Section B.4, “Certificates and Authentication”
.
A digital signature is similar to a handwritten signature. Once data have been signed, it is difficult
to deny doing so later, assuming the private key has not been compromised. This quality of digital
signatures provides a high degree of nonrepudiation; digital signatures make it difficult for the signer
to deny having signed the data. In some situations, a digital signature is as legally binding as a
handwritten signature.
B.4. Certificates and Authentication
•
Section B.4.1, “A Certificate Identifies Someone or Something”
•
Section B.4.2, “Authentication Confirms an Identity”
•
Section B.4.3, “How Certificates Are Used”
•
Section B.4.5, “Contents of a Certificate”
•
Section B.4.6, “How CA Certificates Establish Trust”
B.4.1. A Certificate Identifies Someone or Something
A certificate is an electronic document used to identify an individual, a server, a company, or other
entity and to associate that identity with a public key. Like a driver's license or passport, a certificate