- - yessign Version 3.5 (yessign)

Size: px

Start display at page:

Download "- - yessign Version 3.5 (yessign)"

미소 수
5 years ago
Views:

2 3.6.4 (CRL) (OCSP) (CRL) (OCSP) , S/W , , ( )

3 ( ). ( ) ( ), ( ), ( ), ( ), ,, 5.,, ( ), ( ) ,,, ( ).. - : , URL : - : yessign@kftc.or.kr - : : 02) ,.,.,, ( ), yessign (PKI, Public Key Infrastructure). - -,,, () ( ) 8( ) ,,,,,, -, CRL ,,,,. ( ),,

4 1.3.5 ( ).,. ()., ( ) ( ) ( ) yessign ( CRL ( ),. yessign( CRL, CRL, ,,, ( ), ( ),,,,,. 3( ) ( ), ( ) , ( )., ( ) ( ) ( ) 10. -

5 - - (,, ) ( ) : : yessign@kftc.or.kr : , : FAX : (02) ( ) ( ) : ( ) ( ). - : SMS, : CRL : Certificate Revocation List, - DN : Ditinguished Nae, :, CRL ITU-T X : (IP MAC ) (, ). - yessign :. - : (PC, ),.

6 /(),. 1. OID , ( ) /, / , / / / , ( ),, CTR ,, X X ,. ( : /, ) (CRL) (OCSP) ( ) ,.,. 7, ( ), / ,. -,. -.,. - yessign

7 , ( ) 133().,,.,. -, ( ) -, ( ),, ( ) 4 //.. - (ID) - - ( ) ( ),,.., 7( ) ,, - - -, DN. DN ID. ID,,., CRL ,, ,

8 , DN DN " " " " , (,, ) , ,, ( ) "1.3.7 ". - -, yessign , "3.2.1 " , (CRL) 24 CRL, yessign( "3.6.2 ".

9 3.6.6, "3.2.1 " CRL CRL ( ). S/W, S/W., ( ) (OCSP) (OCSP) OCSP(Online Certificate Status Protocol),, yessign.. S/W., ). 1) # ASN.1 Note 1 Version INTEGER 0x02 ( 3) 2 Serial Nuber INTEGER 3 Signature OID Issuer [KCAC.TS.DN] type OID 4 C(Country) printablestring, printablestring value utf8string utf8string 5 Validity notbefore UTCTie notafter UTCTie [1] Subject [KCAC.TS.DN] type OID 6 C(Country) printablestring, printablestring value utf8string utf8string 7 Subject Public Key Info algorith OID subjectpublickey BIT STRING 8 Extensions Extensions [2] [1] "2.1 ", "3.3 ", "3.4 " [2] 2) # ASN.1 C Note 1 Authority Key Identifier keyidentifier OCTET STRING KeyID n authoritycertissuer GeneralNaes authoritycertserialnuber INTEGER 2 Subject Key Identifier OCTET STRING n subjectpublickey Key Usage BIT STRING c, 4 Certificate Policy policyidentifier OID [1] policyqualifiers PolicyQualifierId OID CPS, UserNotice Qualifier c CPSuri IA5String URI UserNotice NoticeReference SEQUENCE - - ExplicitText BMPString 5 Policy Mappings Subject Alternative Naes othernae n rfc822nae o 7 Issuer Alternative Naes othernae n o id-kisa-identifydata VID id-kisa-identifydata 8 Extended Key Usage OID n o o id-kisa-hsm [2] 9 Basic Constraints - x x 10 Policy Constraints Nae Constraints CRL DistributionPoint distributionpoint DistributionPoint Nae reasons ReasonFlags - - n CRL crlissuer GeneralNaes o CRL Authority Inforation Access accessmethod OID n id-ad-ocsp accesslocation GeneralNaes OCSP URI [1] 2.1 [2] [KCAC.TS.HSM] (id-kisa-hsm)

10 3.10 (CRL) 2) CRL CRL. 1) # ASN.1 Note 1 Version INTEGER 0x01 ( 3) 2 Signature OID Issuer [KCAC.TS.DN] type OID 3 value printablestring utf8string C(Country) printablestring, utf8string 4 This Update UTCTie CRL 5 Next Update UTCTie CRL Revoked Certificates [1] usercertificate INTEGER 6 revocationdata UTCTie crlentryextensions Extensions [2] 7 CRL Extensions Extensions [3] [1] Revoked Certificates [2] 3) CRL [3] 2) CRL # ASN.1 C Note 1 Authority Key Identifier keyidentifier OCTET STRING KeyID n authoritycertissuer GeneralNaes authoritycertserialnuber INTEGER 2 Issuer Alternative Naes othernae n o 3 CRL Nuber INTEGER n 4 Issuing DistributionPoint onlycontainsusercerts BOOLEAN c - - # ASN.1 C Note 1 Reason Code ENUMERATED n 2 Hold Instruction Code OID n o 3 Invalidity Date UTCTie n o 4 Certificate Issuer GeneralNaes c o id-kisa-identifydata DistributionPointNae IA5String CRL [1] onlycontainscacerts BOOLEAN - - onlysoereasons BIT STRING - - IndirectCRL BOOLEAN o [2] [1] CRLDP ([KCAC.TS.DSCP] ) [2] IndirectCRL TRUE 3) CRL 3.11 (OCSP) 2). 1) 3.9, 1). # ASN.1 C Note 1 Authority Key Identifier keyidentifier OCTET STRING n authoritycertissuer GeneralNaes authoritycertserialnuber INTEGER 2 Subject Key Identifier OCTET STRING n subjectpublickey Key Usage BIT STRING c, 4 Certificate Policy policyidentifier OID policyqualifiers PolicyQualifierId OID CPS, UserNotice Qualifier c OCSP CPSuri IA5String URI UserNotice NoticeReference SEQUENCE - - ExplicitText BMPString 5 Policy Mappings Subject Alternative Naes othernae n 7 Issuer Alternative Naes othernae n o 8 Extended Key Usage OID c 9 Basic Constraints - x x 10 Policy Constraints Nae Constraints CRL DistributionPoint distributionpoint DistributionPoint Nae reasons ReasonFlags o n CRL URI id-kisa-identifydata VID id-kisa-identifydata crlissuer GeneralNaes o CRL Authority Inforation Access accessmethod OID n o id-ad-ocsp [1] accesslocation GeneralNaes 14 OCSP No Check OID n o id-pkix-ocsp-nocheck [2] [1] [2] shortlived

11 3.12, ( ) 6.., ( " " )., CRL., 26() ,. - : ldap://ds.yessign.or.kr:389/ - : - : ( "" ) ,, - -, 4.2.2, CRL 24., yessign( 26() ,, - -

12 - - CCTV c ,, , ,, , , , 3T -, k,, , 5.4.1,. -,, - -, ( 2 ) ,, RSA KCDSA : HAS-160 SHA-1 : SHA-256 : ,

13 , //(, ). - // S/W S/W. - S/W , ,. -, //. - // , , , 5.4.2, -. -, , (login) (logoff) ,

14 ( ) , K , , -, Dos. - ( ) ,. -, , Dos IP,. -. -, Dos,, S/W, ID, PASSWORD S/W, IP, S/W ,,, - CRL 6.1.2,, 6.1.1,, ,, 26() , 26 ()

15 ( )., ( ) ( ). -, 2() 3 -, ,, ( ),., 3. - ( ) , yessign,,, yessign,,,. - :, e-ail,,, - : - : IP MAC, HDD Serial, USB Serial, OS,, yessign, yessign ,,,

16 (yessign) - - CRL

yessign Version 3.1 (yessign). ccopyright 2009 yessign ALL RIGHTS RESERVED

yessign Version 3.1 (yessign). ccopyright 2009 yessign ALL RIGHTS RESERVED - - 2000. 8.29. 2000. 8.29. 2001. 7. 5. 2001. 7. 5. 2001.12.17. 2001.12.17. 2002. 3.12. 2002. 3.12. 2002. 8.21. 2002. 9. 5. 2002.12.27.