|
THE BASICS OF THE TECHNOLOGY OF
E-COMMERCE AND THE ELECTRONIC SIGNATURE
Digital certificate
Digital Certificate is a modern alternative
to the classical personal identificator (personal or medical
identification card, passport, bank cards...) with a specific
purpose - ensuring secure and legitimate E-commerce. Presented
as a computer record, it contains data about the holder (name,
e-mail, unique number, ...), his public key, data about the
Certification Authority or the issuer of the digital certificate
and the validity period of the digital certificate, which is
digitally signed with a private key of the issuer of the certificate
(SIGOV-CA or SIGEN-CA).
Digital certificates are an integral element
of technological solutions, which offer two basic possibilities
for privacy in electronic commerce and communication:
The Certification Authority represents an
institution that the holders of digital certificates trust.
The holders mandate it to manage their digital certificates. Figure 1
represents the principle of confidentiality among holders of
digital certificates through a third person - Certification
Authority.
Figure 1
Similarly, the Certification Authority is
an institution that other Certification Authorities or individuals
and indirectly also holders of digital certificates, which the
Certification Authority issued and verified, trust. In this
manner, various Certification Authorities can associate in various
fashion, either horizontally, where they certify each other
and enable secure and reliable communication among holders of
digital certificates of both institutions (e.g., similarly as
in mutual recognition of passports among citizens) or vertically,
when one Certification Authority mandates another institution
for issuing digital certificates in their name, which is necessary
in managing a greater number of digital certificates. In addition,
with mutual recognition the number of e-services, which are
available with individual digital certificates, increases.
Figure 2
The Basic Characteristics of Digital
Certificates SIGOV-CA and SIGEN-CA
Digital certificates are designed for internal
E-commerce or communication in public administration (SIGOV-CA)
and for services, which the public administration offers to
citizens and legal persons electronically (SIGEN-CA). Both certification
authorities issue two types of certificates : enterprise and
web which have different purpose of use. This is made possible
by specific technology and specific characteristics of software
and infrastructure.
While one pair of keys (public and private)
belongs to web digital certificates, two separate pairs of keys
belong to enterprise digital certificates - for digital signing
or certification and for encryption/decryption. Each pair consists
of a private and a public key. The key being public means that
it is publicly accessible or published in a so-called public
directory of certificates. Privacy means that only the holder of the digital
certificate has access to this key.
Figure 3
A pair of keys for encryption/decryption consists
of:
- a private key for decryption,
- a public key for encryption.
A pair of keys for signing/verifying consists
of:
- a private key for signing
- a public key for verifying a signature.
Both pairs of keys are shown in Figure
3.
Figure 4
The procedure of encryption and decryption
is schematically presented in Figure 4. A wishes to send B an
encrypted message. A uses B's public key for encryption, which
can be found in the public directory of certificates. A sends
an encrypted message to B. When B receives the encrypted message,
he decrypts it by using his private key. On condition that A
chose B as the sole recipient of his message, only he can decrypt
it.
The procedure of digital signing is shown
in Figure 5. A digitally signs his message. The digital signature
is designed so that it, first of all, according to a special
procedure, creates a so-called "fingerprint" of the message
- the hash (which assures that it is not possible to change
the messages later - for this fingerprint would not be the same), this
number is encrypted with the private key of the signer (A).
Due to the fact that only A has access to his private key, this is a
guarantee that the signature is really A's. The digitally signed
message, received by B, is composed of a cleartext, encrypted
hash, and A's public key for verifying the signature.
Figure 5
When B wishes to verify A's
digital signature - the procedure is shown in Figure 6 -
B, first of all, decrypts the hash with A's public
key. Once again he calculates the fingerprint of the message from the
cleartext with the same hash algorithm as used by A. If
the two hashes match, this means that the sent message
was truly signed by A.
Illustration 6
A signed electronic message can be read by
everyone, but the content cannot be changed without the changes
being noted. By taking into account that only the signatory
(holder of the digital certificate) knows his own private key,
we can be sure that the message was indeed signed by him.
Two pairs of keys with enterprise digital certificates
give us access and the ability to decrypt encrypted data - also
in cases when the digital certificate, used for encrypting data,
is not valid, or when normal use of the certificate is not possible
due to various reasons. This enables access (readability) of
e-data also in unexpected and unwanted cases, e.g., loss of
password for access of the private key for decrypting data,
damaged smart cards, etc. In such cases, the private key for
decrypting data is securely stored under a specific regime inside
the infrastructure of the Certification Authority at MJU and
is issued only on the request of the holder of the digital certificate,
the head of the organization (whether official digital certificates
or digital certificates for legal persons), or at the request
of the court of competent jurisdiction. The procedure for issuing
a private key for decrypting data is defined in SIGOV-CA Policy
and SIGEN-CA Policy. Based on the above-mentioned characteristics, enterprise
digital certificates are above all designed for official use
(for public administration and for legal persons), and web digital
certificates for citizens.
The other important difference between enterprise
and web digital certificates is validity and regeneration of
keys. The validity of keys for enterprise digital certificates
for signing, encryption and decryption is 3 years and for verification
5 years, the validity of web digital certificates is 5 years.
Enterprise digital certificate keys are renewed automatically
prior to expiration of validity, web digital certificates, on
the other hand, are not automatically renewed. It is necessary
to re-apply for the digital certificate.
|
