Track C · Cryptography

You will be able to

• Explain key pairs, signatures and certificates
• Recognise X.509 and EMV certificates
• Know where RSA is used: EMV offline authentication, TR-34, TLS

The lesson

1. Why it matters
2. The concept
3. Step by step: EMV offline data authentication (DDA)
4. In the real world
5. Common mistakes
6. What to test

In the module

• The lesson, with diagrams, common mistakes and what to test
• A worked example you can change: RSA with small numbers
• Practice: 3 kinds of generated exercise, each with a step-by-step solution
• A quiz of 8 questions

Key terms

CA public key index

The one-byte index (EMV tag 8F) that, with the network's RID, tells the terminal which CA public key to use.

Certificate

A public key with identifying data, signed by a certificate authority. EMV uses its own compact certificate format; TR-34 uses X.509.

Certificate authority (CA)

The party that signs certificates. In EMV the card networks are the CAs, and terminals hold their public keys.

Digital signature

A value computed with a private key over a digest, which anyone with the public key can check.

Modulus

The RSA number n = p × q that both keys share. Its length (such as 2048 bits) is the key size.

PKI (Public key infrastructure)

The CAs, certificates, revocation and procedures that let parties trust each other's public keys.

Private key

The secret half of a key pair: it decrypts and signs. It must never leave its secure device.

Public exponent

The RSA e, usually 3 or 65537, coprime with (p − 1)(q − 1).

Public key

The half of a key pair that can be shared: it encrypts data for the owner or verifies the owner's signatures.

RSA

The public-key algorithm based on factoring: a modulus n = p × q, a public exponent e and a private exponent d. Used for EMV certificates, offline data authentication and TR-34.

Tools for this module: RSA & CertificatesCertificate Inspector

Read the opening of the lesson →