yessign Version 3.1 (yessign). ccopyright 2009 yessign ALL RIGHTS RESERVED

Size: px

Start display at page:

재영 내
5 years ago
Views:

3 yessign ()

4 (CRL)

5 3.6.4 (CRL) (OCSP) (CRL) (OCSP)

6 , S/W , ,

8 yessign ( ). ( ) ( ), ( ), ( ), ( ), ,, 5., ( ) ,,, ( )

9 ,.,.,, ( ), yessign.

10 (PKI, Public Key Infrastructure). - -,,, () 25 ()

11 ( ) 8 ( ) ,,,,,, -, CRL ,,,,. ( ),, ,. ().

12 , ( ) yessign ( CRL ( )

13 8 ( ) ( ),. yessign( CRL, CRL, ,,, ( ), ( ),,,,,. 3 ( )

14 ( ), ( ) , ( )., ( ).

15 ( ) ( ) (,, ) ( )..

16 : ( : yessign@kftc.or.kr : 10-3 : FAX : (02) ( ).

17 ( ) yessign( ( ) ( )

18 :, CRL ITU-T X CRL : Certificate Revocation List, - DN : Ditinguished Name,

19 / ( ),. 1.. ( , ) /, / ( ).

20 ( : /, ) CTR 4, (CRL) CRL , 7,.. yessign

21 ,.

22 ( ), / yessign(

23 3.2.1., ( ) 133().,,.,. -, ( ) -, ( )

24 ,, ( ) 4 //.. - (ID) - - ( ) ( ),,.., 7 ( ) 7.

25 ,, - - -, DN. DN ID. ID,,., CRL ,

26 , ,

27 DN DN " " " " ,.

28 (,, ) , ,,..,,

29 ( ) "1.3.7 ". - -, "3.2.1 ".

30 3.6.4 (CRL) CRL yessign( "3.6.1 " "3.6.2 " "3.2.1 " , CRL CRL ( ) 6.

31 3.7 (OCSP) (OCSP) OCSP(Online Certificate Status Protocol),, yessign.. S/W ( ).

32 3.9. 1) # ASN.1 Note 1 Version INTEGER m m 0x02 ( 3) 2 Serial Number INTEGER m m 3 Signature OID m m 4 5 Issuer m m [KCAC.TS.DN] type OID m m C(Country) printablestring, printablestring value m m utf8string utf8string Validity m m notbefore UTCTime m m [1] notafter UTCTime m m 6 7 Subject m m [KCAC.TS.DN] type OID m m C(Country) printablestring, printablestring value m m utf8string utf8string Subject Public Key Info m m algorithm OID m m subjectpublickey BIT STRING m m 8 Extensions Extensions m m [2] [1] "2.1 ", "3.3 ", "3.4 " [2] 2)

33 2) # ASN.1 C Note 1 Authority Key Identifier keyidentifier OCTET STRING m m KeyID n authoritycertissuer GeneralNames m m authoritycertserialnumber INTEGER m m 2 Subject Key Identifier OCTET STRING n m m m m subjectpublickey Key Usage BIT STRING c m m, 4 Certificate Policy policyidentifier OID m m [1] policyqualifiers m m PolicyQualifierId OID m m CPS, UserNotice Qualifier c m m CPSuri IA5String m m URI UserNotice m m NoticeReference SEQUENCE - - ExplicitText BMPString m m 5 Policy Mappings Subject Alternative Names othername n m m m m rfc822name o m 7 Issuer Alternative Names othername n o m id-kisa-identifydata VID id-kisa-identifydata 8 Extended Key Usage OID n o o id-kisa-hsm [2] 9 Basic Constraints - x x 10 Policy Constraints Name Constraints CRL DistributionPoint distributionpoint DistributionPoint Name reasons ReasonFlags - - n m m m m CRL crlissuer GeneralNames o m CRL Authority Information Access accessmethod OID n m m id-ad-ocsp accesslocation GeneralNames m m OCSP URI [1] 2.1 [2] [KCAC.TS.HSM] (id-kisa-hsm) m m

34 3.10 (CRL) CRL. 1) # ASN.1 Note 1 Version INTEGER m m 0x01 ( 3) 2 Signature OID m m Issuer m m [KCAC.TS.DN] type OID m m 3 C(Country) printablestring, printablestring value m m utf8string utf8string 4 This Update UTCTime m m CRL 5 Next Update UTCTime m m CRL Revoked Certificates m m [1] 6 usercertificate INTEGER m m revocationdata UTCTime m m crlentryextensions Extensions m m [2] 7 CRL Extensions Extensions m m [3] [1] Revoked Certificates [2] 3) CRL [3] 2) CRL

35 2) CRL # ASN.1 C Note 1 Authority Key Identifier keyidentifier OCTET STRING m m KeyID n authoritycertissuer GeneralNames m m authoritycertserialnumber INTEGER m m 2 Issuer Alternative Names othername n o m 3 CRL Number INTEGER n m m m m id-kisa-identifydata Issuing DistributionPoint m m DistributionPointName IA5String m m CRL [1] 4 onlycontainsusercerts BOOLEAN c - - onlycontainscacerts BOOLEAN - - onlysomereasons BIT STRING - - IndirectCRL BOOLEAN o m [2] [1] CRLDP ([KCAC.TS.DSCP] ) [2] IndirectCRL TRUE 3) CRL # ASN.1 C Note 1 Reason Code ENUMERATED n m m 2 Hold Instruction Code OID n o m 3 Invalidity Date UTCTime n o m 4 Certificate Issuer GeneralNames c o m

36 3.11 (OCSP). 1) 3.9, 1).

37 2) # ASN.1 C Note 1 Authority Key Identifier keyidentifier OCTET STRING m m n authoritycertissuer GeneralNames m m authoritycertserialnumber INTEGER m m 2 Subject Key Identifier OCTET STRING n m m m m subjectpublickey Key Usage BIT STRING c m m, 4 Certificate Policy policyidentifier OID m m policyqualifiers m m PolicyQualifierId OID m m CPS, UserNotice Qualifier m m c CPSuri IA5String m m UserNotice m m NoticeReference SEQUENCE - - m m OCSP URI ExplicitText BMPString m m 5 Policy Mappings Subject Alternative Names othername n m m 7 Issuer Alternative Names othername n o m 8 Extended Key Usage OID c m m 9 Basic Constraints - x x 10 Policy Constraints Name Constraints CRL DistributionPoint distributionpoint DistributionPoint Name reasons ReasonFlags o m n m m m m CRL URI id-kisa-identifydata VID id-kisa-identifydata crlissuer GeneralNames o m CRL Authority Information Access accessmethod OID n o m id-ad-ocsp [1] accesslocation GeneralNames 14 OCSP No Check OID n o m id-pkix-ocsp-nocheck [2] [1] [2] shortlived

38 ( ) ( " " ).,

39 .,

40 CRL yessign( : : ldap://ds.yessign.or.kr/ CRL : ldap://ds.yessign.or.kr/ : : : ldap://ds.yessign.or.kr/ 4.2.2, CRL 24., yessign(

41 5. 5.1,,,, ( " " ) ,, - -, ,, - -

42 - - CCTV cm ,, , , 3T -, -

43 ,, , ,, ( ), CRL

44 ,, - -, ( 2 ) ,,

45 RSA KCDSA : HAS-160 SHA-1 : ,

46 , //(, ). - // S/W S/W. - S/W ,.

47 ,. -, //. - // , 12. -

48 - 2 -, 5.4.2, -. -, ,

49 (login) (logoff) , ( )

50 -. -., Km , , -, Dos. - ( )

51 ,. -, , Dos IP,. -. -, Dos,, S/W, ID, PASSWORD S/W, IP, S/W

53 ,,, - CRL 6.1.2,, 6.1.1,, ,, 26 () , 26 ().

54 ( )., ,,.. 6.4

55 24 ( ), ( ) ,,,

56 (yessign) - - CRL

- - yessign Version 3.5 (yessign)

- - yessign Version 3.5 (yessign). 2000. 8.29. 2000. 8.29. 2001. 7. 5. 2001. 7. 5. 2001.12.17. 2001.12.17. 2002. 3.12. 2002. 3.12. 2002. 8.21. 2002. 9. 5. 2002.12.27. 2003. 1.13. 2004. 3.31. 2004. 6.12.