Appendix F. Glossary
F.1. A
- access control
- The process of controlling what particular users are allowed to do. For example, access control to servers is typically based on an identity, established by a password or a certificate, and on rules regarding what that entity can do. See also ???TITLE???.
- access control instructions (ACI)
- An access rule that specifies how subjects requesting access are to be identified or what rights are allowed or denied for a particular subject. See ???TITLE???.
- access control list (ACL)
- A collection of access control entries that define a hierarchy of access rules to be evaluated when a server receives a request for access to a particular resource. See ???TITLE???.
- administrator
- The person who installs and configures one or more Certificate System managers and sets up privileged users, or agents, for them. See also ???TITLE???.
- Advanced Encryption Standard (AES)
- The Advanced Encryption Standard (AES), like its predecessor Data Encryption Standard (DES), is a FIPS-approved symmetric-key encryption standard. AES was adopted by the US government in 2002. It defines three block ciphers, AES-128, AES-192 and AES-256. The National Institute of Standards and Technology (NIST) defined the AES standard in U.S. FIPS PUB 197. For more information, see http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf.
- agent
- A user who belongs to a group authorized to manage ???TITLE??? for a Certificate System manager. See also ???TITLE???, ???TITLE???.
- agent-approved enrollment
- An enrollment that requires an agent to approve the request before the certificate is issued.
- agent services
- Services that can be administered by a Certificate System ???TITLE??? through HTML pages served by the Certificate System subsystem for which the agent has been assigned the necessary privileges.
- The HTML pages for administering such services.
- APDU
- Application protocol data unit. A communication unit (analogous to a byte) that is used in communications between a smart card and a smart card reader.
- attribute value assertion (AVA)
-
An assertion of the form attribute = value, where attribute is a tag, such as
o(organization) oruid(user ID), and value is a value such as "Red Hat, Inc." or a login name. AVAs are used to form the ???TITLE??? that identifies the subject of a certificate, called the ???TITLE??? of the certificate.
- audit log
- A log that records various system events. This log can be signed, providing proof that it was not tampered with, and can only be read by an auditor user.
- auditor
- A privileged user who can view the signed audit logs.
- authentication
- Confident identification; assurance that a party to some computerized transaction is not an impostor. Authentication typically involves the use of a password, certificate, PIN, or other information to validate identity over a computer network. See also ???TITLE???, ???TITLE???, ???TITLE???, ???TITLE???.
- authentication module
- A set of rules (implemented as a Java™ class) for authenticating an end entity, agent, administrator, or any other entity that needs to interact with a Certificate System subsystem. In the case of typical end-user enrollment, after the user has supplied the information requested by the enrollment form, the enrollment servlet uses an authentication module associated with that form to validate the information and authenticate the user’s identity. See ???TITLE???.
- authorization
- Permission to access a resource controlled by a server. Authorization typically takes place after the ACLs associated with a resource have been evaluated by a server. See ???TITLE???.
- automated enrollment
- A way of configuring a Certificate System subsystem that allows automatic authentication for end-entity enrollment, without human intervention. With this form of authentication, a certificate request that completes authentication module processing successfully is automatically approved for profile processing and certificate issuance.
F.2. B
- bind DN
- A user ID, in the form of a distinguished name (DN), used with a password to authenticate to Red Hat Directory Server.
F.3. C
- CA certificate
- A certificate that identifies a certificate authority. See also ???TITLE???, ???TITLE???, ???TITLE???.
- CA hierarchy
- A hierarchy of CAs in which a root CA delegates the authority to issue certificates to subordinate CAs. Subordinate CAs can also expand the hierarchy by delegating issuing status to other CAs. See also ???TITLE???, ???TITLE???, ???TITLE???.
- CA server key
- The SSL server key of the server providing a CA service.
- CA signing key
- The private key that corresponds to the public key in the CA certificate. A CA uses its signing key to sign certificates and CRLs.
- certificate
- Digital data, formatted according to the X.509 standard, that specifies the name of an individual, company, or other entity (the ???TITLE??? of the certificate) and certifies that a ???TITLE???, which is also included in the certificate, belongs to that entity. A certificate is issued and digitally signed by a ???TITLE???. A certificate’s validity can be verified by checking the CA’s ???TITLE??? through ???TITLE??? techniques. To be trusted within a ???TITLE???, a certificate must be issued and signed by a CA that is trusted by other entities enrolled in the PKI.
- certificate authority (CA)
- A trusted entity that issues a ???TITLE??? after verifying the identity of the person or entity the certificate is intended to identify. A CA also renews and revokes certificates and generates CRLs. The entity named in the issuer field of a certificate is always a CA. Certificate authorities can be independent third parties or a person or organization using certificate-issuing server software, such as Red Hat Certificate System.
- certificate-based authentication
- Authentication based on certificates and public-key cryptography. See also ???TITLE???.
- certificate chain
- A hierarchical series of certificates signed by successive certificate authorities. A CA certificate identifies a ???TITLE??? and is used to sign certificates issued by that authority. A CA certificate can in turn be signed by the CA certificate of a parent CA, and so on up to a ???TITLE???. Certificate System allows any end entity to retrieve all the certificates in a certificate chain.
- certificate extensions
- An X.509 v3 certificate contains an extensions field that permits any number of additional fields to be added to the certificate. Certificate extensions provide a way of adding information such as alternative subject names and usage restrictions to certificates. A number of standard extensions have been defined by the PKIX working group.
- certificate fingerprint
- A ???TITLE??? associated with a certificate. The number is not part of the certificate itself, but is produced by applying a hash function to the contents of the certificate. If the contents of the certificate changes, even by a single character, the same function produces a different number. Certificate fingerprints can therefore be used to verify that certificates have not been tampered with.
- Certificate Management Messages over Cryptographic Message Syntax (CMC)
- Message format used to convey a request for a certificate to a Certificate Manager. A proposed standard from the Internet Engineering Task Force (IETF) PKIX working group. For detailed information, see https://tools.ietf.org/html/draft-ietf-pkix-cmc-02.
- Certificate Management Message Formats (CMMF)
- Message formats used to convey certificate requests and revocation requests from end entities to a Certificate Manager and to send a variety of information to end entities. A proposed standard from the Internet Engineering Task Force (IETF) PKIX working group. CMMF is subsumed by another proposed standard, ???TITLE???. For detailed information, see https://tools.ietf.org/html/draft-ietf-pkix-cmmf-02.
- Certificate Manager
- An independent Certificate System subsystem that acts as a certificate authority. A Certificate Manager instance issues, renews, and revokes certificates, which it can publish along with CRLs to an LDAP directory. It accepts requests from end entities. See ???TITLE???.
- Certificate Manager agent
- A user who belongs to a group authorized to manage agent services for a Certificate Manager. These services include the ability to access and modify (approve and reject) certificate requests and issue certificates.
- certificate profile
- A set of configuration settings that defines a certain type of enrollment. The certificate profile sets policies for a particular type of enrollment along with an authentication method in a certificate profile.
- Certificate Request Message Format (CRMF)
- Format used for messages related to management of X.509 certificates. This format is a subset of CMMF. See also ???TITLE???. For detailed information, see https://tools.ietf.org/html/rfc2511.
- certificate revocation list (CRL)
- As defined by the X.509 standard, a list of revoked certificates by serial number, generated and signed by a ???TITLE???.
- Certificate System
- See ???TITLE???, ???TITLE???.
- Certificate System subsystem
- One of the five Certificate System managers: ???TITLE???, Online Certificate Status Manager, ???TITLE???, Token Key Service, or Token Processing System.
- Certificate System console
- A console that can be opened for any single Certificate System instance. A Certificate System console allows the Certificate System administrator to control configuration settings for the corresponding Certificate System instance.
- chain of trust
- See ???TITLE???.
- chained CA
- See ???TITLE???.
- cipher
- See ???TITLE???.
- client authentication
- The process of identifying a client to a server, such as with a name and password or with a certificate and some digitally signed data. See ???TITLE???, ???TITLE???, ???TITLE???.
- client SSL certificate
- A certificate used to identify a client to a server using the SSL protocol. See ???TITLE???.
- CMC
- See ???TITLE???.
- CMC Enrollment
- Features that allow either signed enrollment or signed revocation requests to be sent to a Certificate Manager using an agent’s signing certificate. These requests are then automatically processed by the Certificate Manager.
- CMMF
- See ???TITLE???.
- CRL
- See ???TITLE???.
- cross-pair certificate
- A certificate issued by one CA to another CA which is then stored by both CAs to form a circle of trust. The two CAs issue certificates to each other, and then store both cross-pair certificates as a certificate pair.
- CRMF
- See ???TITLE???.
- cross-certification
- The exchange of certificates by two CAs in different certification hierarchies, or chains. Cross-certification extends the chain of trust so that it encompasses both hierarchies. See also ???TITLE???.
- cryptographic algorithm
- A set of rules or directions used to perform cryptographic operations such as ???TITLE??? and ???TITLE???.
- Cryptographic Message Syntax (CS)
- The syntax used to digitally sign, digest, authenticate, or encrypt arbitrary messages, such as CMMF.
- cryptographic module
- See ???TITLE???.
- cryptographic service provider (CSP)
- A cryptographic module that performs cryptographic services, such as key generation, key storage, and encryption, on behalf of software that uses a standard interface such as that defined by PKCS #11 to request such services.
- CSP
- See ???TITLE???.
F.4. D
- Key Recovery Authority
- An optional, independent Certificate System subsystem that manages the long-term archival and recovery of RSA encryption keys for end entities. A Certificate Manager can be configured to archive end entities' encryption keys with a Key Recovery Authority before issuing new certificates. The Key Recovery Authority is useful only if end entities are encrypting data, such as sensitive email, that the organization may need to recover someday. It can be used only with end entities that support dual key pairs: two separate key pairs, one for encryption and one for digital signatures.
- Key Recovery Authority agent
- A user who belongs to a group authorized to manage agent services for a Key Recovery Authority, including managing the request queue and authorizing recovery operation using HTML-based administration pages.
- Key Recovery Authority recovery agent
- One of the m of n people who own portions of the storage key for the ???TITLE???.
- Key Recovery Authority storage key
- Special key used by the Key Recovery Authority to encrypt the end entity’s encryption key after it has been decrypted with the Key Recovery Authority’s private transport key. The storage key never leaves the Key Recovery Authority.
- Key Recovery Authority transport certificate
- Certifies the public key used by an end entity to encrypt the entity’s encryption key for transport to the Key Recovery Authority. The Key Recovery Authority uses the private key corresponding to the certified public key to decrypt the end entity’s key before encrypting it with the storage key.
- decryption
- Unscrambling data that has been encrypted. See ???TITLE???.
- delta CRL
- A CRL containing a list of those certificates that have been revoked since the last full CRL was issued.
- digital ID
- See ???TITLE???.
- digital signature
- To create a digital signature, the signing software first creates a ???TITLE??? from the data to be signed, such as a newly issued certificate. The one-way hash is then encrypted with the private key of the signer. The resulting digital signature is unique for each piece of data signed. Even a single comma added to a message changes the digital signature for that message. Successful decryption of the digital signature with the signer’s public key and comparison with another hash of the same data provides ???TITLE???. Verification of the ???TITLE??? for the certificate containing the public key provides authentication of the signer. See also ???TITLE???, ???TITLE???.
- distribution points
- Used for CRLs to define a set of certificates. Each distribution point is defined by a set of certificates that are issued. A CRL can be created for a particular distribution point.
- distinguished name (DN)
- A series of AVAs that identify the subject of a certificate. See ???TITLE???.
- dual key pair
- Two public-private key pairs, four keys altogether, corresponding to two separate certificates. The private key of one pair is used for signing operations, and the public and private keys of the other pair are used for encryption and decryption operations. Each pair corresponds to a separate ???TITLE???. See also ???TITLE???, ???TITLE???, ???TITLE???.
F.5. E
- eavesdropping
- Surreptitious interception of information sent over a network by an entity for which the information is not intended.
- Elliptic Curve Cryptography (ECC)
- A cryptographic algorithm which uses elliptic curves to create additive logarithms for the mathematical problems which are the basis of the cryptographic keys. ECC ciphers are more efficient to use than RSA ciphers and, because of their intrinsic complexity, are stronger at smaller bits than RSA ciphers.
- encryption
- Scrambling information in a way that disguises its meaning. See ???TITLE???.
- encryption key
- A private key used for encryption only. An encryption key and its equivalent public key, plus a ???TITLE??? and its equivalent public key, constitute a ???TITLE???.
- enrollment
- The process of requesting and receiving an X.509 certificate for use in a ???TITLE???. Also known as registration.
- end entity
- In a ???TITLE???, a person, router, server, or other entity that uses a ???TITLE??? to identify itself.
- extensions field
- See ???TITLE???.
F.6. F
- Federal Bridge Certificate Authority (FBCA)
- A configuration where two CAs form a circle of trust by issuing cross-pair certificates to each other and storing the two cross-pair certificates as a single certificate pair.
- fingerprint
- See ???TITLE???.
- FIPS PUBS 140
- Federal Information Standards Publications (FIPS PUBS) 140 is a US government standard for implementations of cryptographic modules, hardware or software that encrypts and decrypts data or performs other cryptographic operations, such as creating or verifying digital signatures. Many products sold to the US government must comply with one or more of the FIPS standards. See http://www.nist.gov/itl/fipscurrent.cfm.
- firewall
- A system or combination of systems that enforces a boundary between two or more networks.
F.7. H
- Hypertext Transport Protocol (HTTP) and Hypertext Transport Protocol Secure (HTTPS)
- Protocols used to communicate with web servers. HTTPS consists of communication over HTTP (Hypertext Transfer Protocol) within a connection encrypted by Transport Layer Security (TLS). The main purpose of HTTPS is authentication of the visited website and protection of privacy and integrity of the exchanged data.
F.8. I
- impersonation
- The act of posing as the intended recipient of information sent over a network. Impersonation can take two forms: ???TITLE??? and ???TITLE???.
- input
- In the context of the certificate profile feature, it defines the enrollment form for a particular certificate profile. Each input is set, which then dynamically creates the enrollment form from all inputs configured for this enrollment.
- intermediate CA
- A CA whose certificate is located between the root CA and the issued certificate in a ???TITLE???.
- IP spoofing
- The forgery of client IP addresses.
- IPv4 and IPv6
- Certificate System supports both IPv4 and IPv6 address namespaces for communications and operations with all subsystems and tools, as well as for clients, subsystem creation, and token and certificate enrollment.
F.9. J
- JAR file
- A digital envelope for a compressed collection of files organized according to the ???TITLE???.
- Java™ archive (JAR) format
- A set of conventions for associating digital signatures, installer scripts, and other information with files in a directory.
- Java™ Cryptography Architecture (JCA)
- The API specification and reference developed by Sun Microsystems for cryptographic services. See http://java.sun.com/products/jdk/1.2/docs/guide/security/CryptoSpec.Introduction.
- Java™ Development Kit (JDK)
- Software development kit provided by Sun Microsystems for developing applications and applets using the Java™ programming language.
- Java™ Native Interface (JNI)
- A standard programming interface that provides binary compatibility across different implementations of the Java™ Virtual Machine (JVM) on a given platform, allowing existing code written in a language such as C or C++ for a single platform to bind to Java™. See http://java.sun.com/products/jdk/1.2/docs/guide/jni/index.html.
- Java™ Security Services (JSS)
- A Java™ interface for controlling security operations performed by Network Security Services (NSS).
F.10. K
- KEA
- See ???TITLE???.
- key
- A large number used by a ???TITLE??? to encrypt or decrypt data. A person’s ???TITLE???, for example, allows other people to encrypt messages intended for that person. The messages must then be decrypted by using the corresponding ???TITLE???.
- key exchange
- A procedure followed by a client and server to determine the symmetric keys they will both use during an SSL session.
- Key Exchange Algorithm (KEA)
- An algorithm used for key exchange by the US Government.
- KEYGEN tag
- An HTML tag that generates a key pair for use with a certificate.
F.11. L
- Lightweight Directory Access Protocol (LDAP)
- A directory service protocol designed to run over TCP/IP and across multiple platforms. LDAP is a simplified version of Directory Access Protocol (DAP), used to access X.500 directories. LDAP is under IETF change control and has evolved to meet Internet requirements.
- linked CA
- An internally deployed ???TITLE??? whose certificate is signed by a public, third-party CA. The internal CA acts as the root CA for certificates it issues, and the third- party CA acts as the root CA for certificates issued by other CAs that are linked to the same third-party root CA. Also known as "chained CA" and by other terms used by different public CAs.
F.12. M
- manual authentication
- A way of configuring a Certificate System subsystem that requires human approval of each certificate request. With this form of authentication, a servlet forwards a certificate request to a request queue after successful authentication module processing. An agent with appropriate privileges must then approve each request individually before profile processing and certificate issuance can proceed.
- MD5
- A message digest algorithm that was developed by Ronald Rivest. See also ???TITLE???.
- message digest
- See ???TITLE???.
- misrepresentation
- The presentation of an entity as a person or organization that it is not. For example, a website might pretend to be a furniture store when it is really a site that takes credit-card payments but never sends any goods. Misrepresentation is one form of ???TITLE???. See also ???TITLE???.
F.13. N
- Network Security Services (NSS)
- A set of libraries designed to support cross-platform development of security-enabled communications applications. Applications built using the NSS libraries support the ???TITLE??? protocol for authentication, tamper detection, and encryption, and the PKCS #11 protocol for cryptographic token interfaces. NSS is also available separately as a software development kit.
- nonrepudiation
- The inability by the sender of a message to deny having sent the message. A ???TITLE??? provides one form of nonrepudiation.
- non-TMS
- Non-token management system. Refers to a configuration of subsystems (the CA and, optionally, KRA and OCSP) which do not handle smart cards directly. See also ???TITLE???.
F.14. O
- object signing
- A method of file signing that allows software developers to sign Java code, JavaScript scripts, or any kind of file and allows users to identify the signers and control access by signed code to local system resources.
- object-signing certificate
- A certificate whose associated private key is used to sign objects; related to ???TITLE???.
- OCSP
- Online Certificate Status Protocol.
- one-way hash
- A number of fixed-length generated from data of arbitrary length with the aid of a hashing algorithm. The number, also called a message digest, is unique to the hashed data. Any change in the data, even deleting or altering a single character, results in a different value.
- The content of the hashed data cannot be deduced from the hash.
- operation
- The specific operation, such as read or write, that is being allowed or denied in an access control instruction.
- output
- In the context of the certificate profile feature, it defines the resulting form from a successful certificate enrollment for a particular certificate profile. Each output is set, which then dynamically creates the form from all outputs configured for this enrollment.
F.15. P
- password-based authentication
- Confident identification by means of a name and password. See also ???TITLE???, ???TITLE???.
- PKCS #7
- The public-key cryptography standard that governs signing and encryption.
- PKCS #10
- The public-key cryptography standard that governs certificate requests.
- PKCS #11
- The public-key cryptography standard that governs cryptographic tokens such as smart cards.
- PKCS #11 module
- A driver for a cryptographic device that provides cryptographic services, such as encryption and decryption, through the PKCS #11 interface. A PKCS #11 module, also called a cryptographic module or cryptographic service provider, can be implemented in either hardware or software. A PKCS #11 module always has one or more slots, which may be implemented as physical hardware slots in some form of physical reader, such as for smart cards, or as conceptual slots in software. Each slot for a PKCS #11 module can in turn contain a token, which is the hardware or software device that actually provides cryptographic services and optionally stores certificates and keys. Red Hat provides a built-in PKCS #11 module with Certificate System.
- PKCS #12
- The public-key cryptography standard that governs key portability.
- private key
- One of a pair of keys used in public-key cryptography. The private key is kept secret and is used to decrypt data encrypted with the corresponding ???TITLE???.
- proof-of-archival (POA)
- Data signed with the private Key Recovery Authority transport key that contains information about an archived end-entity key, including key serial number, name of the Key Recovery Authority, ???TITLE??? of the corresponding certificate, and date of archival. The signed proof-of-archival data are the response returned by the Key Recovery Authority to the Certificate Manager after a successful key archival operation. See also ???TITLE???.
- public key
- One of a pair of keys used in public-key cryptography. The public key is distributed freely and published as part of a ???TITLE???. It is typically used to encrypt data sent to the public key’s owner, who then decrypts the data with the corresponding ???TITLE???.
- public-key cryptography
- A set of well-established techniques and standards that allow an entity to verify its identity electronically or to sign and encrypt electronic data. Two keys are involved, a public key and a private key. A ???TITLE??? is published as part of a certificate, which associates that key with a particular identity. The corresponding private key is kept secret. Data encrypted with the public key can be decrypted only with the private key.
- public-key infrastructure (PKI)
- The standards and services that facilitate the use of public-key cryptography and X.509 v3 certificates in a networked environment.
F.16. R
- RC2, RC4
- Cryptographic algorithms developed for RSA Data Security by Rivest. See also ???TITLE???.
- Red Hat Certificate System
- A highly configurable set of software components and tools for creating, deploying, and managing certificates. Certificate System is comprised of five major subsystems that can be installed in different Certificate System instances in different physical locations: ???TITLE???, Online Certificate Status Manager, ???TITLE???, Token Key Service, and Token Processing System.
- registration
- See ???TITLE???.
- root CA
- The ???TITLE??? with a self-signed certificate at the top of a certificate chain. See also ???TITLE???, ???TITLE???.
- RSA algorithm
- Short for Rivest-Shamir-Adleman, a public-key algorithm for both encryption and authentication. It was developed by Ronald Rivest, Adi Shamir, and Leonard Adleman and introduced in 1978.
- RSA key exchange
- A key-exchange algorithm for SSL based on the RSA algorithm.
F.17. S
- sandbox
- A Java™ term for the carefully defined limits within which Java™ code must operate.
- Simple Certificate Enrollment Protocol (SCEP)
- A protocol designed by Cisco to specify a way for a router to communicate with a CA for router certificate enrollment. Certificate System supports SCEP’s CA mode of operation, where the request is encrypted with the CA signing certificate.
- secure channel
- A security association between the TPS and the smart card which allows encrypted communciation based on a shared master key generated by the TKS and the smart card APDUs.
- Secure Sockets Layer (SSL)
- A protocol that allows mutual authentication between a client and server and the establishment of an authenticated and encrypted connection. SSL runs above TCP/IP and below HTTP, LDAP, IMAP, NNTP, and other high-level network protocols.
- security domain
- A centralized repository or inventory of PKI subsystems. Its primary purpose is to facilitate the installation and configuration of new PKI services by automatically establishing trusted relationships between subsystems.
- Security-Enhanced Linux (SELinux)
- Security-enhanced Linux (SELinux) is a set of security protocols enforcing mandatory access control on Linux system kernels. SELinux was developed by the United States National Security Agency to keep applications from accessing confidential or protected files through lenient or flawed access controls.
- self tests
- A feature that tests a Certificate System instance both when the instance starts up and on-demand.
- server authentication
- The process of identifying a server to a client. See also ???TITLE???.
- server SSL certificate
- A certificate used to identify a server to a client using the ???TITLE??? protocol.
- servlet
- Java™ code that handles a particular kind of interaction with end entities on behalf of a Certificate System subsystem. For example, certificate enrollment, revocation, and key recovery requests are each handled by separate servlets.
- SHA
- Secure Hash Algorithm, a hash function used by the US government.
- signature algorithm
- A cryptographic algorithm used to create digital signatures. Certificate System supports the MD5 and ???TITLE??? signing algorithms. See also ???TITLE???, ???TITLE???.
- signed audit log
- See ???TITLE???.
- signing certificate
- A certificate whose public key corresponds to a private key used to create digital signatures. For example, a Certificate Manager must have a signing certificate whose public key corresponds to the private key it uses to sign the certificates it issues.
- signing key
- A private key used for signing only. A signing key and its equivalent public key, plus an ???TITLE??? and its equivalent public key, constitute a ???TITLE???.
- single sign-on
- In Certificate System, a password that simplifies the way to sign on to Red Hat Certificate System by storing the passwords for the internal database and tokens. Each time a user logs on, he is required to enter this single password.
- The ability for a user to log in once to a single computer and be authenticated automatically by a variety of servers within a network. Partial single sign-on solutions can take many forms, including mechanisms for automatically tracking passwords used with different servers. Certificates support single sign-on within a ???TITLE???. A user can log in once to a local client’s private-key database and, as long as the client software is running, rely on ???TITLE??? to access each server within an organization that the user is allowed to access.
- slot
- The portion of a ???TITLE???, implemented in either hardware or software, that contains a ???TITLE???.
- smart card
- A small device that contains a microprocessor and stores cryptographic information, such as keys and certificates, and performs cryptographic operations. Smart cards implement some or all of the ???TITLE??? interface.
- spoofing
-
Pretending to be someone else. For example, a person can pretend to have the email address
jdoe@example.comor a computer can identify itself as a site calledwww.redhat.comwhen it is not. Spoofing is one form of ???TITLE???. See also ???TITLE???.
- SSL
- See ???TITLE???.
- subject
- The entity identified by a ???TITLE???. In particular, the subject field of a certificate contains a ???TITLE??? that uniquely describes the certified entity.
- subject name
- A ???TITLE??? that uniquely describes the ???TITLE??? of a ???TITLE???.
- subordinate CA
- A certificate authority whose certificate is signed by another subordinate CA or by the root CA. See ???TITLE???, ???TITLE???.
- symmetric encryption
- An encryption method that uses the same cryptographic key to encrypt and decrypt a given message.
F.18. T
- tamper detection
- A mechanism ensuring that data received in electronic form entirely corresponds with the original version of the same data.
- token
- A hardware or software device that is associated with a ???TITLE??? in a ???TITLE???. It provides cryptographic services and optionally stores certificates and keys.
- token key service (TKS)
- A subsystem in the token management system which derives specific, separate keys for every smart card based on the smart card APDUs and other shared information, like the token CUID.
- token management system (TMS)
- The interrelated subsystems — CA, TKS, TPS, and, optionally, the KRA - which are used to manage certificates on smart cards (tokens).
- transport layer security (TLS)
- A set of rules governing server authentication, client authentication, and encrypted communication between servers and clients.
- token processing system (TPS)
- A subsystem which interacts directly the Enterprise Security Client and smart cards to manage the keys and certificates on those smart cards.
- tree hierarchy
- The hierarchical structure of an LDAP directory.
- trust
- Confident reliance on a person or other entity. In a ???TITLE???, trust refers to the relationship between the user of a certificate and the ???TITLE??? that issued the certificate. If a CA is trusted, then valid certificates issued by that CA can be trusted.
F.19. U
- UTF-8
- The certificate enrollment pages support all UTF-8 characters for specific fields (common name, organizational unit, requester name, and additional notes). The UTF-8 strings are searchable and correctly display in the CA, OCSP, and KRA end user and agents services pages. However, the UTF-8 support does not extend to internationalized domain names, such as those used in email addresses.
F.20. V
- virtual private network (VPN)
- A way of connecting geographically distant divisions of an enterprise. The VPN allows the divisions to communicate over an encrypted channel, allowing authenticated, confidential transactions that would normally be restricted to a private network.
F.21. X
- X.509 version 1 and version 3
- Digital certificate formats recommended by the International Telecommunications Union (ITU).
