7.2 X.509

7.2 X.509

To understand X.509, we need to discuss something called X.500. Think of a telephone directory; X.500 is much like your local phone directory. You start with a person's name and, using that name, you can look up information about that person, such as his or her phone number and address. In the case of X.500, you can access many different items about that person, including his or her e-mail address. The concept of an X.500 directory is that the displays can represent any system entity, not just people but computers, businesses, and governments. The entry can also contain the certificate specifying the person's public key. Both X.509 and X.500 were designed in the mid-1980s, before the advent of the Internet.

The lookup method to X.500 is based on a property known as a DN. (Just what we need another acronym!) DN, which stands for "distinguished name," is a method to look up entries in a directory. The DN must be unique in the directory and will be arranged using a hierarchical methodology. This seems to be more confusing terminology. Actually, here is what all this means. A directory (of names) will be organized into a logical structure that someone who is looking for a name could follow. Using an X.500 directory structure, all information held in the directory would be known as the "directory information base," or DIB. The DIB contains entries that are related hierarchically to each other.

Now your next question would be, "What is an entry?" Every entity has attributes associated with it. An attribute comprises an attribute type and one or more associated values. One example of an attribute type would be "office phone number," and the attribute value might be "8-1234." The entries held in the DIB are formatted using a tree structure, which is similar to a structure chart used by most hierarchical organizations. The DIB would be similar to looking at a tree from the top down. In this example you may want to know Bill's office phone number. The problem is that there are 200 Bills in the Company. Looking at the tree from the top down, you can then follow the structure. You may know that Bill works for the Company. You may also know that Bill works in Dallas, Texas. With that information you can find Bill and then read his phone number. In Figure 7.1, Bill's DN is "Bill/Dallas/Texas/the Company." This name format is known as a "canonical" name. If there were a country identifier, then you would have an additional display shown, such as "C = US." These identifiers show each component of a name.

Figure 7.1

• CN = Common Name

• OU = Organization Unit

• O = Organization

• C = Country

Using the X.500 directory we can now find our way around and manage names within our organization. This is where X.509 arrives. As we said, each entry in an X.500 directory will have attributes and values. One of those attributes can and will be an e-mail address, and a place for a public key. Using these attributes, we can do several tasks: send e-mail; send encrypted e-mail; validate a signature; and authenticate against a directory.

This is very powerful, so place a mental bookmark here. We will be discussing directories more as we go on.

X.509 focuses on defining a mechanism by which information can be made available in a secure way to a third party and it supports the authentication of the entries in an X.500 directory. Every X.509 certificate will be "signed" by a certificate authority, or CA. The main purpose of a CA is to bind a public key to the name contained in the certificate, which will provide assurance to third parties that some measure of care was taken to ensure that this binding is valid. Figure 7.2 shows the features of an X.509v2 certificate.

Figure 7.2