請問簽名係咩原理?

3ldk

一般常見既解釋就係話: 你可以gen一對private key同public key, 然後將public key比人, 人地用public key加密完比你, 你就可以用private key解返出黎

如果照依個解釋, 正常制作証書既流程理應係咁:
1. 用openssl gen private key
2. 再用private key gen public key, 依條public key就當做cert
3. 將private key同cert放係server
4. 用戶睇網頁時會順便download埋張cert
5. submit form果陣會用cert加密, server收到後就用private key解密

但實際上, 制作証書既流程卻係咁:
1. 用openssl gen private key
2. 再用private key gen csr
3. send csr比CA, CA再用佢自己既private加你既csr gen public key出黎比你
4. 你收到public key就當成你張cert


雖然話CA係第三方組織, 用黎證明你張cert係真的, 就算係咁, 其實將自己張cert send比CA備案, 咁就足以做證明
但而家卻不是send cert比CA, 而係send csr比CA, 佢仲要用自己private key gen cert出黎, 咁gen出黎的public key仲會同你原本條private key配對到嗎?
究竟CA所謂既簽名係簽左D乜?

javacomhk

Cert is public key + meta data

When you use ssl to generate keys, you generate both private key and public key pair.
When you request csr, you send your public key + meta data to CA and in return a certification verified by CA.

即是話 public key 係你自己 generate 出來，唔係 CA generate 嘅。CA 係負責在簽名證明張 cert (你嘅 public key＋ 你嘅  server 嘅 meta data) 是已登記嘅。

a certificate (your public key +meta data) is itself signed by a certificate authority (CA) using CA's private key. This verifies the authenticity of the certificate.



This pic explained the usage of the ssl certificate (with public key inside) verified by CA.

Ferrari2010

一般常見既解釋就係話: 你可以gen一對private key同public key, 然後將public key比人, 人地用public key加 ...
3ldk 發表於 2022-12-22 17:29

CA用簽名證明certificate 持有人係authentic
避免了每次TLS handshake 需要瀏覽器多一個traffic 去CA 確認。可以加快速度

KinChungE

情況等於, D員工準備文件, 然後老細簽名
內容其實老細冇份做, 但係肯簽名就當有效+信得過

員工做既野 = csr
老細睇完簽個名 = 證明佢睇左, 有記錄低, 咁就當係有效

如果CA發現樣樣樣都唔妥都照簽就係CA既錯, 會俾人罰錢 + 隨時連成張CA cert revoke

KinChungE

其實... 應該 講 數學? 原理 好似 是 2 個 數 (public key, private key) 乘出來 的 答案....

public key  ...
toylet 發表於 2022-12-28 18:51

數學證明到點verify資料冇改過
但係未足夠用黎證明個簽名有效
否則self-signed cert都已經係"valid" signature

java2

你講的是簽發TLS 証書?
實際上用openssl gen csr 會同時生成key pair (public key + private key) 和 CSR(含public key)
你將CSR 給CA 簽發一張cert 給你,  那張cert 含你本來的public key 也有CA 的public key.
cert連同本來的private key 就可以裝到app server.

一般常見既解釋就係話: 你可以gen一對private key同public key, 然後將public key比人, 人地用public key加 ...
3ldk 發表於 2022-12-22 17:29

java2

好似 是 2 個 數 (public key, private key) 乘出來 的 答案
未有 興趣 睇, 但有 興趣 吹.

其實... 應該 講 數學?
原理 好似 是 2 個 數 (public key, private key) 乘出來 的 答案....
脷伸:   :no ...
toylet 發表於 2022-12-28 18:51