Online Certificate Status Protocol - Basic PKI Implementation

Basic PKI Implementation

  1. Alice and Bob have public key certificates issued by Ivan, the Certificate Authority (CA).
  2. Alice wishes to perform a transaction with Bob and sends him her public key certificate.
  3. Bob, concerned that Alice's private key may have been compromised, creates an 'OCSP request' that contains Alice's certificate serial number and sends it to Ivan.
  4. Ivan's OCSP responder reads the certificate serial number from Bob's request. The OCSP responder uses the certificate serial number to look up the revocation status of Alice's certificate. The OCSP responder looks in a CA database that Ivan maintains. In this scenario, Ivan's CA database is the only trusted location where a compromise to Alice's certificate would be recorded.
  5. Ivan's OCSP responder confirms that Alice's certificate is still OK, and returns a signed, successful 'OCSP response' to Bob.
  6. Bob cryptographically verifies Ivan's signed response. Bob has stored Ivan's public key sometime before this transaction. Bob uses Ivan's public key to verify Ivan's response.
  7. Bob completes the transaction with Alice.

Read more about this topic:  Online Certificate Status Protocol

Famous quotes containing the word basic:

    “Justice begins with the recognition of the necessity of sharing. The oldest law is that which regulates it, and this is still the most important law today and, as such, has remained the basic concern of all movements which have at heart the community of human activities and of human existence in general.”
    —Elias Canetti (b. 1905)