Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

2-166
Configuring the ProCurve Wireless Edge Services xl Module
Digital Certificates
Overview
Digital certificates rely on asymmetric encryption with public/private key
pairs. Data encrypted by a private key must be decrypted by the corresponding
public key. A host “signs” data by encrypting it with its private key—something
only it can do because only it knows the private key. Other hosts verify the
signature by decrypting the signature with the public key.
A digital certificate ties a public key to a particular host’s identity. Typically, a
trusted third-party, called the certificate authority (CA), issues certificates. A
less secure option is a self-signed certificate, which is issued by the host itself.
In either case, the issuer of a certificate is referred to as a trustpoint.
A certificate itself consists of:
■ the host’s identification information
■ the host’s public key
■ the function used to hash the certificate
■ the CA’s digital signature
A host authenticates itself by sending its certificate, to which it appends its
digital signature. It creates the digital signature by hashing the certificate and
then encrypting the hash with its private key.
When the peer receives the digital certificate, the peer extracts the host’s
public key and hash function. The peer decrypts and unhashes the signature
and compares it to the certificate. If the signature and certificate match, the
peer knows that no one has tampered with the certificate en route.
To fully authenticate a host, the peer must also have the CA’s certificate in its
system. This certificate includes the CA’s public key, which the peer uses to
verify the CA’s signature. A genuine CA signature attests that the holder of a
certificate is who it says it is. CAs also issue certificate revocation lists (CRLs),
which list certificates that are no longer valid.
Because a host can freely distribute its public key, it can authenticate itself to
anyone who trusts the host’s CA. However, no one can pose as the host,
because only the host’s unshared, private key can encrypt and “sign” the
certificate.