Hi I am a little new to security, but in researching digital certificates it seems the only format people describe is X.509.
Are there other formats? If so what are they and where can I find information on them?
9
$\begingroup$
$\endgroup$
-
1$\begingroup$ Google is always your best friend. A quick search came up with this and this. Is this what you mean? $\endgroup$ – rath Dec 31 '13 at 12:34
-
$\begingroup$ @rath I do not think so :/ Your links list formats for X.509 certificates (to store or transmit them). But I think the question is whether there are other "quasi-standards" for certificates and PKI besides PKIX, i.e., RFC5280. But I may be wrong :) $\endgroup$ – DrLecter Dec 31 '13 at 13:47
-
1$\begingroup$ You might be right. I'm not familiar with that format anyway so I posted the links just in case. Cheers $\endgroup$ – rath Dec 31 '13 at 13:51
-
$\begingroup$ Ok ;) One alternative that comes up to my mind is SPKI. But I am not sure if this approach ever has made it to some practical application. $\endgroup$ – DrLecter Dec 31 '13 at 13:52
3
$\begingroup$
$\endgroup$
Quote from http://www.digi-sign.com/node/10922
All Types of Digital Certificates Are Also a X509 Certificate
A X509 certificate *refers to all types of digital certificates, regardless of how they are utilized, and implies the current standardization used to design and create digital certificates. This standardization recognizes that the information, data and other embedded objects within a digital certificate are all placed exactly in the same location and in the same order. As a result, these standards make it possible for digital certificates of all kinds to be shared between individuals and organizations, as well as allow for applications to use a single digital certificate, in place of multiple certificates. For instance, word processing, spreadsheets, data bases, and presentation software suites can be designed to use a single digital certificate in order to authenticate the user and verify they have a valid copy of the software installed on their computer. Without the X509 standards, users would have to have one digital certificate for each application, regardless of whether it was bundled as a suite or purchased separately.
That's the reason why you keep seeing X509 everywhere.
-
2$\begingroup$ The title of that quote is a bit misleading ... it suggests that X.509 is a standard incorporating all other standards (or a format incorporating all other certificate formats), but actually it only says that every certificates for every use case can be expressed in X.509. $\endgroup$ – Paŭlo Ebermann Jan 7 '14 at 22:48
-
$\begingroup$ Or more concisely, I think it says that X509 certificates are generic certificates that are not tied to a particular use. I think the last sentences are a bit misleading. If I buy a digital certificate for a server, it does not make sense to use it to sign word documents as well. You can certainly make clear in how a certificate should be used within the certificate itself. The format is generic, the certificate itself may be particular to a use case. $\endgroup$ – Maarten Bodewes♦ Aug 29 '14 at 12:23
-
3$\begingroup$ The title of that quote is not even wrong, as a type can't be meaningfully compared to a certificate. $\;$ And truth is: NOT all Digital Certificates are also a X.509 certificate. $\endgroup$ – fgrieu Aug 29 '14 at 19:38
10
$\begingroup$
$\endgroup$
Although x.509 is the standard for PKIs with CAs, different certificate formats have been defined for the other 2 major PKI approaches:
- SPKI has defined its own certificate format , still (forever?) in draft status.
- Web-of-Trust models usually use the OpenPGP certificate format defined in RFC2440
RFC4212 "Alternative Certificate Formats for the Public-Key Infrastructure Using X.509 (PKIX) Certificate Management Protocols" may also be of interest.
-
1$\begingroup$ There are yet other Digital Certificate formats; see this answer $\endgroup$ – fgrieu Aug 29 '14 at 15:28
4
$\begingroup$
$\endgroup$
Card verifiable certificates (CVC) are rather important for smart card technologies. In general X509 certificates have a rather complex structure and may take a lot of room compared to the RAM and EEPROM/flash memory that is available in a smart card chip.
It is certainly possible to parse an X509 certificate in a processor card (it's a generic processor, so it's a Turing machine, so given enough memory...), but a flatter, more dense structure with fewer optional features and a fixed order of elements makes more sense.
-
2$\begingroup$ An example of use of CVC is in the European Digital Tachograph Smart Card; see Council Regulation 3821/85 (ammended), Annex 1B, Appendix 11, section 3.3 (starting at CSM_016) $\endgroup$ – fgrieu Aug 29 '14 at 15:15
-
1$\begingroup$ @fgrieu And each and every European passport that holds fingerprints, of course. Note that CVC certificates are mainly used to authenticate terminals to smart cards. For ID applications (where the holder is authenticated) normal X509 certificates are used - the smart card is then just used as secure storage device with regards to the certificate. And I do know at least two other smart card applications that use CVC's. $\endgroup$ – Maarten Bodewes♦ Sep 22 '14 at 12:27
-
$\begingroup$ by any chance, do you know what European regulation (or other spec) defines the CVCs in those European passports that hold one? $\endgroup$ – fgrieu Sep 22 '14 at 15:42
-
1$\begingroup$ @fgrieu Yeah, if I'm not mistaken that would be TR-03110 v1.11... $\endgroup$ – Maarten Bodewes♦ Sep 22 '14 at 22:22
