15: Security in Detail
EDS User Guide
145
EDS currently supports the following list of cipher suites:
Certificate
Key exchange
Encryption
Hash
DSA
DHE
3DES
SHA1
RSA
RSA
128 bits AES
SHA1
RSA
RSA
Triple DES
SHA1
RSA
RSA
128 bits RC4
MD5
RSA
RSA
128 bits RC4
SHA1
RSA
1024 bits RSA
56 bits RC4
MD5
RSA
1024 bits RSA
56 bits RC4
SHA1
RSA
1024 bits RSA
40 bits RC4
MD5
Whichever side is acting as server decides which cipher suite to use for a connection.
It is usually the strongest common denominator of the cipher suite lists supported by
both sides.
Certificates
The goal of a certificate is to authenticate its sender. It is like a paper document that
contains personal identification information and is signed by an authority, for example
a notary or government agency.
Security Certificate Principles
To sign other certificates, the authority uses a private key.
The published authority certificate contains the matching public key that
allows another to verify the signature but not recreate it.
The authority’s certificate can be signed by itself, resulting in a self-signed or
trusted-root certificate, or by another (higher) authority, resulting in an
intermediate authority certificate.
You can build up a chain of intermediate authority certificates, and the last
certification will always be a trusted-root certificate.
An authority that signs other’s certificates is also called a Certificate Authority (CA).
The last in line is then the root-CA.
VeriSign is a famous example of such a root-CA. Its certificate is often built
into web browsers to allow verifying the identity of website servers, which
need to have certificates signed by VeriSign or another public CA.
Since obtaining a certificate signed by a CA that is managed by another company
can be expensive, it is possible to become your own CA. Tools exist to generate self-
signed CA certificates or to sign other certificates.
A certificate before it is signed is known as a certificate request, which only
contains the identifying information. Signing it makes it a certificate.
