PKI

1. Certificate Encode
   1. PEM:Privacy Enhanced Mail
   2. DER:Distinguished Encoding Rules
2. Certificate Extension Name
   1. CRT
   2. PEM
   3. CER
   4. KEY
   5. PFX/P12
   6. JKS
   7. CSR: Certificate Signing Requst
3. `openssl` command
   1. Generate self-sign certificate
      1. openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem
   2. Generate CSR
      1. openssl req -newkey rsa:2048 -new -nodes -keyout my.key -out my.csr
   3. Display the Certificate Information
      1. PEM
         1. openssl x509 -in certificate.pem -text -noout
      2. DER
         1. openssl x509 -in certificate.der -inform der -text -noout
4. Digital Certificate? or Public Key Certificate
   1. Public Key + Owner Information + Digital Signature Signed by CA
5. Structure
   1. Abstract Syntax Notation (ASN): describe the structure
      1. ASN serves the same purpose as a DTD or an XSD might serve in an XML context
   2. TOP level
      1. version
      2. serialNumber
      3. signature
         1. CA sign
         2. Self-sign for test
         3. object identifier (OID)
            1. MD5withRSA: 1.2.840.113549.1.1.4 = 2A 86 48 86 F7 0D 01 01 04
            2. SHA-1withRSA: 2A 86 48 86 F7 0D 01 01 05
      4. issuer
         1. Distinguished Name
      5. validity
      6. subject
      7. subjectPublicKeyInfo
      8. issuerUniqueID
      9. subjectUniqueID
      10. extensions

Annotations:

• CA sign the Digital certificate

1. SSL(TLS)
2. SAML
3. Software Licence
4. PDF signature
5. SSH

1. private key cryptography
   1. DES，Data Encryption Standard
   2. AES, Advanced Encryption Standard (128,192, 256)
   3. RC4
   4. IDEA
2. public key cryptography
   1. RSA, Rivest, Shamir, Adleman: length>768 has not been cracked. So 1024 basic security and 2018 is more security
   2. Digital Signature Algorithm, DSA, Only signature
   3. Diffie-Hellman: Only for exchange key
   4. ECC, Elliptic curve cryptography
3. Digest Algorithm
   1. SHA Secure Hash Algorithm
      1. SHA-1 : 160-bit
      2. SHA-2: SHA256: 256-bit
   2. MD5 Message-Digest Algorithm 5
   3. CRC Cyclic Redundancy Check