cisco exam chapter 3

cisco exam chapter 3.PKI binds a public key to the identity of a person, an application, and a unit. Such a "binding relationship" is maintained by a certificate authority (CA) in the form of issuing and managing digital certificates.6.3.1 Public and Private Key PairsAn u key pair is a set of two keys that operate in a matching fashion. A key pair typically includes a public key and a whole ko a private key. The public key can be shared with everyone, while the private key is in your possession only and must not be disclosed to anyone. For example, the private key of a web server can only be held by that web server itself. If you encrypt data with a public key (using an asymmetric encryption algorithm), you can only decrypt the data with the matching private key. And vice versa, if you use the private key to encrypt, you can only use the matching public key to decrypt. You can also call this asymmetric encryption publickeycryptography or asymmetric key encryption (asymmetrickeycryptography). The uses of asymmetric algorithms are not limited to authentication; for example, the digital signatures discussed earlier in this chapter are just one of the uses of asymmetric algorithms ~ O306 Chapter 6 Cryptography and Public Key Infrastructure ( PKI ) Basics6.3.2 RSA Algorithms, Keys, and Digital Certificates Keys are cryptographic objects that are used to achieve confidentiality through cryptography. This takes a closer look at the RSA-related/§u( I. Root point keys and their usage.* With RSA digital signatures, each party has to have a pair of public keys . Private keys, because both parties need to perform authentication of each other. Still using that example of two users named Batman and Robin. As shown in Figure 6.2 and Figure 6.3, both users have generated their own public-private key pairs, both registered with a certificate authority (CA). The CA will use each user's public key, name, and IP address to create a digital certificate, which will be sent back to Batman and Robin, respectively. The CA also digitally signs each certificate.When Batman and Robin need to authenticate with each other, they send their digital certificates (or copies of their digital certificates) to each other. After receiving the digital certificate from the other party, both parties verify the authenticity of the digital certificate by checking the digital signature of the CA they currently trust (when a user trusts a certificate authority, it means that the user knows the identity of the CA and can verify the CA's digital signature by using the public key of the CA in their possession).With each other's public keys in hand, Batman and Robin can immediately perform mutual authentication. Such mutual authentication (enabling RSA signatures to authenticate VPN endpoints) is typically required when establishing a two-way VPN tunnel. For simplicity, this section will focus only on one of the parties (computer Batman) proving their identity to the other party (computer Robin).Batman takes some data, generates a hash first, and encrypts the hash with his private key (note that the private key must not be revealed to anyone else - not even Batman's closest friends). This encrypted hash is passed to Robin along with the data (which will be attached to the packet). This encrypted hash is Batman's digital signature.