Answered: 1)Alice wants to make a purchase from…

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Related questions

Concept explainers

Question

100%

1)Alice wants to make a purchase from Etailer.com, an online retail store. She notices that her web browser received a copy of Etailer.com's X.509 certificate, which contains Etailer.com's public key. Alice notices that the certificate also includes an RSA signature from a certificate authority(CA).

a) how can alice be sure that the public key listed on the certificate really belongs to Etailer.com? be specific

b) what would be the security impact if a CA was compromised in some manner? be specific

c)why can Alice rely on the CA to validate Etailer.com's certificate? be specific

Expert Solution

Step 1

In cryptography, X.509 is a standard form of public key certificates.
When an organization like by given problem Etailer.com wants a X.509 certificate,it requests via a certificate signing request(CSR).
It generates a key pair - one public key and one private key, keeping the private key secret and using it to sign the CSR.
The CSR is accompanied by credentials or proofs of identity required by the certificate authority(CA).
A certificate authority is an entity that ensures the ownership of a public key by the named subject of the certificate.
After accepting the CSR, the certification authority issues a certificate binding a public key to a particular distinguished name.
This certification allows others (relying parties) to be sure that the private key corresponds to the certified entity only.
CAs are trusted third parties for the browsers' users.
Hence, alice can be sure that the public key listed on the certificate really belongs to Etailer.com.

Step 2

If a CA is compromised in some manner, it can be used to spoof someone.
Suppose,an attacker is able to steal a certificate authority's private key.Now he is able to issue certificates by claiming himself as the certificate authority.
So the relying parties on the original Certificate Authority will be unknowingly are trapped by the attacker.
This type of security breach can be happened if a CA is compromised.

Trending now

This is a popular solution!

Step by step

Solved in 3 steps

Knowledge Booster

Learn more about

Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.

Similar questions