The main confusion I have is around the different PKCS and relation with SSL (TLS). I have done a lot of research and have found bits and pieces but not necessarily how these relate, so let me explain but first with a little background.
To start, I am fairly comfortable with how SSL (and subsequently TLS) works, and subsequently mutual TLS. Typically X.509 certs with CA signed for mutual authentication, and sometimes using self signed certs. Also with how the symmetric key is used for the content encryption and the asymmetric key is used for encrypting the symmetric key.
I am also fairly comfortable with PGP, encrypting, signing, different algorithms, features like built in zip compression, etc. Particular interest in RSA encryption and signature algorithms, but more on that later. So, so far we have SSL which security can be enhanced if you encrypt a payload before using the transport level encryption, especially if you're sending data somewhere where you don't want any data to be unencrypted at rest.
Now on to PKCS where it starts to get a little hazy. I know that PKCS are just standards.
PKCS#12 - These are your .pfx or .p12 files, which can be used to store your X.509 certs with the corresponding private key (very simplistic definition). My guess, and please correct me if I'm wrong, is that these are typically created be a server which wants to setup HTTPS. Can use different algorithms, like RSA which is also mentioned in PGP.
PKCS#7 - Subsequently CMS, typically used for generating and verifying digital signatures. Here is where I'm finding some conflicting information. I understand
digital signatures, calculate the hash encrypt with the private key so you can verify, with the public key, that the message was not tampered with and that it came from the correct sender. Before I get to the main question relating to auth, I see that PKCS#7 can use AES, which is a symmetric key algorithm. Does this make sense, and if so is this common or how would that work?
Now main questions sorry if that was long winded.
- I was told to download a PFX file in order to authenticate with an
API, similar to this question. Question on this, and related to
my next question on PKCS7, is how does that authentication work? I'm
getting the private key and cert in the form of a
.pfxfile from the server, does that mean that the server is just self signing this and this is essentially mutual TLS using a self signed cert? If not, we then just be using TLS (so encrypted with the servers public key) with the message content being our payload signed with our private key?
- Similar for PKCS7. I completely understand how we verify the signature with the public key. How how do we handle the authentication if we are sending data across to some API (typically speaking)? Because technically once we have something that we have a digital signature, really anyone anywhere can send this, so how would we know it is being sent by a particular client or do we not care?
Sorry for the long post and hopefully you can clear some of this up for me.