Borland VisiBroker® 7.0 - Borland Technical Publications

Authentication and IdentificationSymmetric encryptionSymmetric encryption uses only one key for both encryption and decryption. Althoughfaster than asymmetric encryption, is requires an already secure channel to exchangethe keys, and allows only a single communication.Certificates and Certificate AuthorityWhen you distribute your public key, the recipients of that key need some sort ofassurance that you are indeed who you claim to be. The ISO X.509 standard defines amechanism called a certificate, which contains a user's public key that has beendigitally signed by a trusted entity called a Certificate Authority (CA). When a clientapplication receives a certificate from a server, or vice-versa, the CA that issued thecertificate can be used to verify that it did indeed issue the certificate. The CA acts likea notary and a certificate is like a notarized document.You obtain a certificate by constructing a certificate request and sending it to a CA.Digital signaturesDigital signatures are similar to handwritten signatures in terms of their purpose; theyidentify a unique author. Digital signatures can be created through a variety ofmethods. Currently, one of the more popular methods involves an encrypted hash ofdata.1 The sender produces a one-way hash of the data to be sent.2 The sender digitally signs the data by encrypting the hash with a private key.3 The sender sends the encrypted hash and the original data to the recipient.4 The recipient decrypts the encrypted hash using the sender's public key.5 The recipient produces a one-way hash of the data using the same hashingalgorithm as the sender.6 If the original hash and the derived hash are identical, the digital signature is valid,implying that the document is unchanged and the signature was created by theowner of the public key.Generating a private key and certificate requestTo obtain a certificate to use in your application, you need to first generate a privatekey and certificate request. To automate this process, for Java applications you canuse the Java keytool, or for C++ applications you can use open source tools likeOpenSSL utility.After you generate the files, you should submit the certificate request to a CA. Theprocedure for submitting your certificate request to a CA is determined by thecertificate authority which you are using. If you are using a CA that is internal to yourorganization, contact your system administrator for instructions. If you are using acommercial CA, you should contact them for instructions on submitting your certificaterequest. The certificate request you send to the CA will contain your public key andyour distinguished name.14 VisiBroker Security Guide