ACME: PKI Basics скачать в хорошем качестве

ACME: PKI Basics

I've had a couple of my coworkers ask me to explain how to work with certificates, and I also had an offline suggestion that it would be cool and helpful if I could talk a bit about ACME certificates. The people want to know! Who am I to deny them? This is the first part of a three-part series I'll be doing on ACME certificates. In this part, we're talking about what a certificate actually is: demonstrating how a public/private keypair works, demonstrating how it can be used to encrypt or to sign a document (depending on which key you use), and then discussing how this is used for a certificate authority to sign certificates and establish trust. EXTRA CREDIT: Rivest-Shamir-Adleman (RSA) keys come in a variety of bit-lengths. 1024-bit RSA keys were deemed insecure 10 years ago, and 2048-bit RSA keys are standard today. 4096-bit RSA keys are also available, but nothing larger. Elliptic-curve cryptography (ECC) keys also come in a variety of bit lengths. A 256-bit ECC key provides roughly the same security as a 3072-bit RSA key; a 384-bit ECC key is roughly equivalent to a theoretical 7680-bit RSA key. We actually don't use public-private keypairs to encrypt messages directly! Because the math is intentionally difficult, we only use these asymmetric keys to exchange a symmetric key used for a different system such as AES. Symmetric algorithms require less processing power and can handle more traffic in the same amount of time, but they can be difficult to secure if you don't already have an established secure communication method to transfer the key. But with asymmetric keys, you can create a secure channel knowing that nobody else can see you while you negotiate a key for your faster symmetric algorithm!