BSI 23/30447023 DC 2023
$13.70
BS EN ISO/IEC 9594-12. Information technology. Open systems interconnection – Part 12. The Directory. Public key infrastructure establishment and maintenance
Published By | Publication Date | Number of Pages |
BSI | 2023 | 86 |
PDF Catalog
PDF Pages | PDF Title |
---|---|
1 | 30447023-NC.pdf |
3 | ISO_IEC DIS 9594-12 ed.1 – id.84119 Enquiry PDF (en).pdf |
9 | 1 Scope 2 Normative references 2.1 Identical Recommendations | International Standards 2.2 Recommendations 2.3 Others |
10 | 3 Definitions 3.1 OSI reference model security architecture definitions 3.2 Baseline identity management terms and definitions 3.3 Terms defined in public-key and attribute certificate frameworks |
11 | 3.4 Key management and public-key infrastructure establishment and maintenance definitions |
12 | 4 Abbreviations |
14 | 5 Conventions 6 Cyber security consideration for communication networks 6.1 The challenge of large ICT networks |
15 | 6.2 Connection-mode communication 6.2.1 General |
16 | 6.2.2 Association establishment phase 6.2.3 Data transfer phase |
17 | 6.2.4 Association termination phase 6.3 Symmetric key requirements |
18 | 7 Introduction to cryptographic algorithms |
19 | 8 Hash algorithms 8.1 General |
20 | 8.2 The SHA-2 series of hash algorithms 8.2.1 Referenced specifications 8.2.2 The SHA-2 model |
21 | 8.2.3 The SHA-2 characteristics 8.2.4 SHA-2 formal specification |
22 | 8.3 The Kᴇᴄᴄᴀᴋ algorithms |
24 | 8.4 SHA-3 characteristics |
25 | 8.5 SHA-3 formal specifications 8.5.1 SHA3-224 specification 8.5.2 SHA3-256 specification 8.5.3 SHA3-256 specification 8.5.4 SHA3-512 specification 8.5.5 SHAKE-128 and SHAKE-256 specifications 8.5.6 SHAKE-128-len and SHAKE-256-len specifications 9 Public-key algorithms and digital signature algorithms 9.1 General |
27 | 9.2 The RSA public-key algorithm 9.2.1 General 9.2.2 Key generation |
28 | 9.2.3 Security considerations 9.2.4 RSA asynchronous encryption/decryption 9.2.5 Signature generation and verification |
29 | 9.3 The DSA public-key algorithm 9.4 The elliptic curve digital signature algorithm (ECDSA) 9.4.1 General |
30 | 9.4.2 Defines curves 9.4.3 Key generation 9.4.4 Security considerations |
31 | 9.4.5 Signature generation and verification 9.5 Edwards-curve digital signature algorithm 9.5.1 General 9.5.2 Defined digital signature algorithms |
32 | 9.5.3 Key generation 9.5.4 Security issues 9.5.5 Signature generation and verification 10 Key establishment algorithms 10.1 Introduction |
33 | 10.2 Key transport 10.2.1 RSA key transport 10.3 Key agreement 10.3.1 The Diffie-Hellman key agreement method |
35 | 10.4 Key derivation functions 10.4.1 General 10.4.2 HMAC-based extract-and-expand key derivation function |
36 | 11 Symmetric-key algorithms 11.1 Stream ciphers vs. block ciphers 11.2 Advanced encryption standard 11.2.1 General |
38 | 11.2.2 The octet substitution layer |
39 | 11.2.3 The Shift Rows layer |
40 | 11.2.4 The mix columns layer 11.2.5 The add round key layer 11.3 Modes of advance encryption standard 11.3.1 Overview of AES modes |
41 | 11.3.2 Advanced encryption standard – electronic codebook (AES-ECB) mode 11.3.3 Advanced encryption standard – cipher block chaining (AES-CBC) |
42 | 11.3.4 Cipher feedback mode 11.3.5 Output feedback mode 11.3.6 Counter mode |
43 | 12 Authenticated encryption with associated data (AEAD) algorithms 12.1 General 12.2 Advanced encryption standard – Galois/counter mode (AES-GCM) 12.3 Advanced encryption standard (AES)- Counter with CBC-MAC (CCM) |
44 | 13 Integrity check value (ICV) algorithms 13.1 Introduction 13.2 Keyed-hash message authentication code (HMAC) |
45 | 13.3 Cipher-based message authentication code (CMAC) 13.4 Kᴇᴄᴄᴀᴋ message authentication code (KMAC) 13.4.1 General |
46 | 13.4.2 Input message constructions 13.4.3 KMAC formal specifications |
47 | 13.5 Advance encryption standard (AES) – Galois message authentication code (GMAC) algorithm 14 Security strength |
48 | 15 Random number generation and entropy 16 Post-quantum considerations |
49 | 17 Hardware security modules |
50 | 18 Introduction to the section 19 Public-key certificates 19.1 Content of a basic public-key certificate 19.1.1 Structure 19.1.2 Distinguished name considerations |
51 | 19.1.3 Version component 19.1.4 Serial number component 19.1.5 Signature component |
52 | 19.1.6 Issuer component 19.1.7 Validity component 19.1.8 Subject component 19.1.9 Subject public‑key information 19.1.10 Issuer unique ID and subject unique ID |
53 | 19.2 Extensions 19.2.1 Use of extensions for public-key certificates 19.2.2 Basic constraints extension 19.2.3 Key usage extension 19.2.4 Subject directory attribute extension type |
54 | 19.2.5 Subject alternative name extension 19.2.6 Authority information access extension 20 Trust establishment 20.1 General |
55 | 20.2 Single public-key infrastructure domain |
56 | 20.3 Trust establishment between two public-key infrastructure domains 20.4 A worldwide federated public-key infrastructure. |
57 | 20.5 Trust anchor compromise 21 Identity verification in a machine-to-machine environment 21.1 General 21.2 The two-PKIs approach |
58 | 21.3 Use of the shared secret approach 21.4 Operational PKI establishment 22 PKI configurations 22.1 Introduction |
59 | 22.2 PKI components 23 Certification path processing 23.1 Certification path |
60 | 23.2 Name chaining 23.3 Key identifier chaining |
61 | 24 Certification path validation 24.1 Overview |
62 | 24.2 Validating certification path |
63 | 24.3 Validating individual public-key certificates |
65 | Annex€A Size of Public-key certificates |
69 | Annex€B Basic mathematic concepts for cryptographic algorithms |
85 | Bibliography |