Chain of trust: Difference between revisions
m Reverted edits by 2404:160:A41A:9A56:1535:E208:89CF:5100 (talk) to last version by Yuhkih |
|||
| (9 intermediate revisions by 8 users not shown) | |||
| Line 1: | Line 1: | ||
{{short description |Ordered list of certificates to establish trust}} |
|||
{{Unreferenced stub|auto=yes|date=December 2009}} |
|||
{{Use British English |date=February 2024}} |
|||
| ⚫ | |||
{{Use dmy dates |date=February 2024}} |
|||
{{More citations needed |date=February 2024}} |
|||
| ⚫ | |||
In computer security, a '''chain of trust''' is established by validating each component of [[computer hardware|hardware]] and [[software]] from the end entity up to the root certificate. It is intended to ensure that only trusted software and hardware can be used while still retaining flexibility. |
In computer security, a '''chain of trust''' is established by validating each component of [[computer hardware|hardware]] and [[software]] from the end entity up to the root certificate. It is intended to ensure that only trusted software and hardware can be used while still retaining flexibility. |
||
==Introduction== |
==Introduction== |
||
A chain of trust is designed to allow multiple users to create and use software on the system, which would be more difficult if all the keys were stored directly in hardware. It starts with hardware that will only boot from software that is [[Digital signature|digitally signed]]. The signing authority will only sign boot programs that enforce security, such as only running programs that are themselves signed, or only allowing signed code to have access to certain features of the machine. This process may continue for several layers. |
A chain of trust is designed to allow multiple users to create and use the software on the system, which would be more difficult if all the keys were stored directly in hardware. It starts with hardware that will only boot from software that is [[Digital signature|digitally signed]]. The signing authority will only sign boot programs that enforce security, such as only running programs that are themselves signed, or only allowing signed code to have access to certain features of the machine. This process may continue for several layers. |
||
This process results in a chain of trust. The final software can be trusted to have certain properties |
This process results in a chain of trust. The final software can be trusted to have certain properties because if it had been illegally modified its signature would be invalid, and the previous software would not have executed it. The previous software can be trusted, because it, in turn, would not have been loaded if its signature had been invalid. The trustworthiness of each layer is guaranteed by the one before, back to the [[trust anchor]]. |
||
It would be possible to have the hardware check the suitability (signature) for every single piece of software. However, this would not produce the flexibility that a "chain" provides. In a chain, any given link can be replaced with a different version to provide different properties, without having to go all the way back to the trust anchor. This use of multiple layers is an application of a general technique to improve scalability |
It would be possible to have the hardware check the suitability (signature) for every single piece of software. However, this would not produce the flexibility that a "chain" provides. In a chain, any given link can be replaced with a different version to provide different properties, without having to go all the way back to the trust anchor. This use of multiple layers is an application of a general technique to improve scalability and is analogous to the use of multiple certificates in a [[Root certificate|certificate chain]]. |
||
==Computer security== |
==Computer security== |
||
In computer security, digital certificates are verified using a chain of trust. The trust anchor for the digital certificate is the root [[certificate authority]] (CA). |
In computer security, digital certificates are verified using a chain of trust.<ref name="dc23" /> The trust anchor for the digital certificate is the root [[certificate authority]] (CA). |
||
The certificate hierarchy is a structure of certificates that allows individuals to verify the validity of a certificate's issuer. Certificates are issued and signed by certificates that reside higher in the certificate hierarchy, so the validity and trustworthiness of a given certificate is determined by the corresponding validity of the certificate that signed it. |
The certificate hierarchy is a structure of certificates that allows individuals to verify the validity of a certificate's issuer. Certificates are issued and signed by certificates that reside higher in the certificate hierarchy, so the validity and trustworthiness of a given certificate is determined by the corresponding validity of the certificate that signed it. |
||
| Line 17: | Line 20: | ||
The chain of trust of a certificate chain is an ordered list of certificates, containing an end-user subscriber certificate and [[intermediate certificate authority|intermediate certificates]] (that represents the intermediate CA), that enables the receiver to verify that the sender and all intermediate certificates are trustworthy. This process is best described in the page ''[[Intermediate certificate authority]]''. See also [[X.509#Certificate chains and cross-certification|X.509 certificate chains]] for a description of these concepts in a widely used standard for digital certificates. |
The chain of trust of a certificate chain is an ordered list of certificates, containing an end-user subscriber certificate and [[intermediate certificate authority|intermediate certificates]] (that represents the intermediate CA), that enables the receiver to verify that the sender and all intermediate certificates are trustworthy. This process is best described in the page ''[[Intermediate certificate authority]]''. See also [[X.509#Certificate chains and cross-certification|X.509 certificate chains]] for a description of these concepts in a widely used standard for digital certificates. |
||
==See also== |
|||
* [[Root of trust]] |
|||
* [[Web of trust]] |
|||
== References == |
|||
{{reflist |refs= |
|||
<ref name="dc23">{{cite web |title=How Certificate Chains Work |date=2023-11-01 |website=DigiCert |url=https://knowledge.digicert.com/solution/how-certificate-chains-work |access-date=2024-02-09 }}</ref> |
|||
}} |
|||
{{DEFAULTSORT:Chain Of Trust}} |
{{DEFAULTSORT:Chain Of Trust}} |
||
[[Category: |
[[Category:Data security]] |
||
[[Category:Trusted computing]] |
[[Category:Trusted computing]] |
||
[[Category:Public-key cryptography]] |
[[Category:Public-key cryptography]] |
||
Latest revision as of 10:02, 4 September 2024
 | This article needs additional citations for verification. (February 2024) |
In computer security, a chain of trust is established by validating each component of hardware and software from the end entity up to the root certificate. It is intended to ensure that only trusted software and hardware can be used while still retaining flexibility.
Introduction
[edit]A chain of trust is designed to allow multiple users to create and use the software on the system, which would be more difficult if all the keys were stored directly in hardware. It starts with hardware that will only boot from software that is digitally signed. The signing authority will only sign boot programs that enforce security, such as only running programs that are themselves signed, or only allowing signed code to have access to certain features of the machine. This process may continue for several layers.
This process results in a chain of trust. The final software can be trusted to have certain properties because if it had been illegally modified its signature would be invalid, and the previous software would not have executed it. The previous software can be trusted, because it, in turn, would not have been loaded if its signature had been invalid. The trustworthiness of each layer is guaranteed by the one before, back to the trust anchor.
It would be possible to have the hardware check the suitability (signature) for every single piece of software. However, this would not produce the flexibility that a "chain" provides. In a chain, any given link can be replaced with a different version to provide different properties, without having to go all the way back to the trust anchor. This use of multiple layers is an application of a general technique to improve scalability and is analogous to the use of multiple certificates in a certificate chain.
Computer security
[edit]In computer security, digital certificates are verified using a chain of trust.[1] The trust anchor for the digital certificate is the root certificate authority (CA).
The certificate hierarchy is a structure of certificates that allows individuals to verify the validity of a certificate's issuer. Certificates are issued and signed by certificates that reside higher in the certificate hierarchy, so the validity and trustworthiness of a given certificate is determined by the corresponding validity of the certificate that signed it.
The chain of trust of a certificate chain is an ordered list of certificates, containing an end-user subscriber certificate and intermediate certificates (that represents the intermediate CA), that enables the receiver to verify that the sender and all intermediate certificates are trustworthy. This process is best described in the page Intermediate certificate authority. See also X.509 certificate chains for a description of these concepts in a widely used standard for digital certificates.
See also
[edit]References
[edit]- ^ "How Certificate Chains Work". DigiCert. 1 November 2023. Retrieved 9 February 2024.