¶ Public Key Infrastructure (PKI) for the DCC
¶ Relationship between the DCC and the Public Key Infrastructure
After providing a DCC from a calibration laboratory to a customer, it should be ensured that the DCC
- really originates from the specified calibration laboratory,
- has actually been released by the calibration laboratory, and
- is unchanged.
To ensure this, the use of digital signatures from a PKI is recommended.
The concept of the digital signature, which is based on the public-key encryption procedure, in conjunction with public-key certificates within a public-key infrastructure makes this possible.
¶ Definition: Public key infrastructure
Public Key Infrastructure refers to a system that can issue, distribute, and verify Public Key Certificates.
¶ Public Key Certificates
¶ Purpose
The public-key certificates issued within a PKI are used to cryptographically secure computer-based communication.
¶ Assurances of Public-Key Certificates
A public-key certificate provides the following assurances:
-
Proof that the public key used belongs to the sender of a digitally signed message.
-
Assurance that the key is authorized to be used with that specific cryptographic algorithm and for its intended purpose when encrypting and verifying a digital signature.
¶ Key Concept
This describes the two main functions of a certificate:
-
Binding Identity to a Key: The certificate acts as a trusted, verified link between an entity (like the PTB) and their public key. This is the core of authentication.
-
Defining Key Usage: Certificates contain fields that specify exactly how the key can be used (e.g., for digital signatures, for key encryption). This prevents a key from being misused for a purpose it wasn't designed for, which could be a security risk.
¶ Public-Key Encryption Procedure
¶ Concept
Jeder Benutzer kann sein eigenes Schlüsselpaar, das aus einem geheimen Teil (privater Schlüssel) und einem nicht geheimen Teil (öffentlicher Schlüssel) besteht, erzeugen. Der Besitzer eines Schlüsselpaars kann dann in beliebiger Reihenfolge einen der beiden Schlüssel zur Verschlüsselung und den anderen zur Entschlüsselung von Nachrichten verwenden.
Any user can generate their own key pair, which consists of a secret part (private key) and a non-secret part (public key). The owner of a key pair can then use one of the two keys for encryption and the other for decryption of messages in any order.
¶ PKI as a Certification Authority
For a key pair to be used for secure message exchange, the owner of the private key must share their public key with communication partners. To prove ownership, a public key certificate is required.
To obtain such a digital certificate, the owner submits their public key as a Certificate Signing Request (CSR) to the PKI. The PKI then issues a public key certificate back to the owner. This certificate contains:
-
Details about the owner,
-
The owner’s public key,
-
A digitally signed hash of the certificate itself.
Optionally, the PKI may store the certificate in a publicly accessible database for verification purposes
¶ Public Key
The public key is generated by the owner. Its association with the owner is proven by the PKI through a public-key certificate.
The public key enables anyone to encrypt data for the owner of the private key, verify their digital signatures, or authenticate them.
¶ Summary of the Public Key's Role
| Function | Description | Analogy |
|---|---|---|
| Encryption | Allows anyone to encrypt data that only the private key holder can decrypt. | Putting a message into a locked box that only the recipient can open. |
| Signature Verification | Allows anyone to verify a digital signature created with the corresponding private key. This is its primary role for a DCC. | Anyone can check the unique wax seal on a document to confirm it's genuine. |
| Authentication | Used to verify the identity of the holder of the private key. | A system can challenge a user to prove they have the private key, without the key itself being revealed. |
Crucial Point: The public key is meant to be widely distributed. Its trustworthiness is not inherent but is established by the public-key certificate issued by a trusted PKI, which binds the key to a specific identity (like the PTB).
¶ Private Key
Only the owner possesses the private key. It is secret.
The private key enables its owner to decrypt data encrypted with the public key, generate digital signatures, or authenticate themselves.
Summary of the Private Key's Role
| Function | Description | Analogy |
|---|---|---|
| Decryption | It decrypts data that was encrypted using its corresponding public key. | Unlocking a safe that someone else locked using your public lock. |
| Creating Digital Signatures | It is used to mathematically sign a digital document (like a DCC). This is the core of its function for a calibration certificate. | Putting your unique, unforgeable wax seal on a document. |
| Authentication | It proves the owner's identity to a system or service. | Showing your ID card (which only you possess) to prove who you are. |
Crucial Point: The security of the entire system depends on the private key remaining secret. If it is compromised, an attacker can impersonate the owner and forge signatures.
¶ The Digital Signature of the DCC
When the owner of a private key uses it to encrypt a message, this encrypted message is called a digital signature.
Any other user can now obtain the public key via the PKI and use it to decrypt the message.
¶ DCC as an Application of a PKI
A Public Key Infrastructure (PKI) addresses critical security requirements for Digital Calibration Certificates (DCCs) by ensuring:
-
Authenticity & Non-Repudiation: The origin of a DCC can be irrefutably verified, independent of its format.
-
Integrity: A DCC cannot be tampered with or altered without detection.
-
Tamper-Evidence: The DCC is effectively forgery-proof.
-
Controlled Validity: DCCs can be deliberately revoked if necessary.
-
Secure Channels: Enables secure communication with the calibration laboratory.
In summary, the use of digital signatures and public-key certificates within a PKI framework provides the foundation for trust, security, and legal validity in digital metrology.