Authentication; Message Integrity - Cisco 11503 - CSS Content Services Switch Configuration Manual

SSL Cryptography Overview

Authentication

Message Integrity

Cisco Content Services Switch SSL Configuration Guide
1-4
Authentication is necessary for one or more devices in the exchange to verify that
the party to whom they are talking is really who they claim to be. For example,
assume a client is connecting to an e-commerce website. Before sending sensitive
information such as a credit card number, the client verifies that the server is an
e-commerce website. In certain instances, it may be necessary for both the client
and the server to authenticate themselves to each other before beginning the
transaction. In a financial transaction between two banks, both the client and the
server need to be confident that the other is who they say they are. SSL facilitates
this authentication through the use of digital certificates.
Digital certificates are a form of digital identification to prove the identity of the
client to the server. A Certificate Authority (CA) issues digital certificates in the
context of a PKI, which uses public-key and private-key encryption to ensure
security. CAs are trusted authorities who "sign" certificates to verify their
authenticity. Clients or servers connected to the CSS must have trusted
certificates from the same CA, or from different CAs in a hierarchy of trusted
relationships (for example, "A" trusts "B," and "B" trusts "C," therefore "A"
trusts "C").
A certificate ensures that the identification information is correct, and that the
public key actually belongs to that client or server. Digital certificates contain
information such as details about the owner, details about the certificate issuer,
the owner's public key, validity and expiration dates, and associated privileges.
Upon receiving a certificate, a client can connect to the certificate issuer and
verify the validity of the certificate using the issuer's public key. This ensures that
the certificate is actually issued and signed by an authorized entity. A certificate
remains valid until it expires or is terminated.
Message integrity is a means of assuring the recipient of a message that the
contents of the message have not been tampered with during transit. SSL achieves
this by applying a message digest to the data before transmitting it. A message
digest is a function that takes an arbitrary length message and outputs a
fixed-length string that is characteristic of the message.
Chapter 1 Overview of CSS SSL
OL-5655-01