In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
Authentication can be done via certificates.
Certificate is a digital statement, signed with a digital signature. Under the hood, digital signatures use asymmetric cryptography, which is a fascinated technology. The math behind it allows us to do miraculous things.
For example, it allows verification of the communicating party without sharing the private key. With password authentication you have to share passwords between parties before you can establish secure communication. You also need to protect the passwords on both sides of communication. However, with digital certificates, you only need to protect private key on one side, that is twice less the attack surface.
Identity verification in this case is done by “certificate authorities” (CAs). We nominate and agree on the list of the authorities, pre-load their signatures on our machines. CAs verify the identity of the party via DNS domain ownership and/or paperwork. If the identity is correct, they undersign the party’s digital signature with the CA’s digital signature. That chain of signatures, or “chain of trust,” is then checked by the communicating parties.
Because the parties offload trust establishment to the certificate authority, they don’t need sign-up (or registration) process themselves.
Application examples
When you connect to your Internet Bank, you authenticate the bank via TLS certificate. You don’t need to “sign-up” the bank on your browser, and you don’t need to know the bank’s private key.
Risks
Weak authentication is usually considered as “High” risk.
Common name (CN) validation is a common oversight. When you are focussed on checking the chain of digital signatures, it is easy to forget validation of the certificate common name (CN) field. CN field contains the name of the party you intend to communicate with. If the name does not match the intention, that is an indicator of compromise. It means that a valid certificate from one party is being re-used by another party. If we compare certificates to passports, it is the same as using stolen valid passport. CN would be the name of the passport holder.
Another problem with certificate authentication is certificate expiration. Communication will be broken if you forget to renew the certificate, that is why automatic certificate renewal is so important. Until recently, it was mostly a manual process.
Certificate compromise is an unlikely risk. Just in case it happens, there are mechanisms to notify parties via certificate revocation lists.
Quirks
Asymmetric cryptography in TLS communications is used for authentication only. It is computationally complex and slow. As soon as authentication is complete, TLS protocol establishes encryption in transit with faster, symmetric cryptography.
Further reading
Pocket Guide: Authentication – Passwords
Pocket Guide: Two-Factor Authentication
Please check out the map of cyber security controls below. It is simple yet awesome.
