Q21Information System Security

In Asymmetric Cryptography, Alice must broadcast her Public Key. A catastrophic vulnerability exists: A hacker (Darth) can mathematically generate a key pair, broadcast his own Public Key, and falsely claim "I am Alice." The X.509 Authentication Service is the absolute architectural solution to this crisis. It provides a massive, globally distributed mathematical framework for issuing and verifying Digital Certificates.

X.509 relies entirely on a trusted third-party architecture called a Certificate Authority (CA) (e.g., DigiCert, Let's Encrypt).

• 1. Amazon generates a Public/Private key pair.
• 2. Amazon sends its Public Key and its corporate identity documents to the CA.
• 3. The CA mathematically validates Amazon's identity in the physical world.
• 4. The CA violently hashes Amazon's Public Key + Identity Data, and Encrypts that hash using the CA's own highly guarded Private Key. This creates the X.509 Digital Certificate.
• 5. When a browser connects to Amazon, it receives this Certificate. The browser uses the CA's universally known Public Key to mathematically decrypt the signature. If it matches, it provides absolute cryptographic proof that the Public Key inside truly belongs to Amazon.

An X.509 certificate is a rigidly formatted mathematical data structure containing strict fields:

• 1. Version: Identifies the mathematical version of the standard (v1, v2, or v3). v3 allows critical extensions.
• 2. Serial Number: An absolute unique integer assigned by the CA to specifically identify this exact certificate.
• 3. Signature Algorithm Identifier: The exact mathematical algorithm the CA used to sign the certificate (e.g., sha256WithRSAEncryption).
• 4. Issuer Name: The mathematically formatted X.500 Distinguished Name (DN) of the CA that created and signed the certificate (e.g., CN=DigiCert Global Root CA).
• 5. Validity Period: Two exact mathematical timestamps defining the absolute lifespan of the certificate (Not Before and Not After). If the current time is outside this window, the browser violently rejects the connection.
• 6. Subject Name: The specific entity (Amazon.com) that owns the Public Key.
• 7. Subject Public Key Information: The absolute core of the document. It contains the actual Public Key bits (e.g., a 2048-bit RSA string) and the mathematical algorithm identifier required to use it.
• 8. Extensions (v3 only): Crucial architectural additions like Key Usage (restricting the key to Digital Signatures only) and Subject Alternative Name (allowing the certificate to cover multiple domains like amazon.co.uk).
• 9. Certificate Signature: The final mathematical seal. The raw encrypted hash generated by the CA's Private Key.