They do sort of gloss over the details of SSL, don't they? :)
When you think about it though, it makes sense. If the certificate was just
transmitted directly back the server, then anyone with the certificate could
pretend to be that client. Since certificates are essentially public data,
one should always assume that the certificate could be possessed by many
people.
The real security aspect in PKI is the possession of the private key that
matches the public key in the certificate. Since we don't ever send the
private key directly to anyone, the way we prove we have the private key is
by signing a piece of data with it. If the signature validates with the
public key, we know the signer has the private key for that certificate.
Note that when doing SSL with only server authentication, the server does
the same thing. This is how you know that it has the private key for its
certificate as well.
One resource that I've actually found to be pretty good in this space are
the crypto articles on Wikipedia. They are pretty high level (very
encyclopedia-type writing), but reasonably thorough and not too technical.
They also have good pointers to additional detail. Reading up on SSL and
PKI there might be a good starting point.
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net --
[quoted text, click to view] <gudujarlson@gmail.com> wrote in message
news:1179934358.565060.155130@p77g2000hsh.googlegroups.com...
>I had some familiarity with public-private keys at a theoretical level
> and in the context of SSH and PGP prior to this project, but I had
> never used them with ASP.NET. I think this problem would have been
> easier to figure out if the .NET documentation was better. In
> particular this document could have more detail.
>
> ms-help://MS.VSCC.v80/MS.MSDN.v80/MS.NETDEVFX.v20.en/cpref10/html/
> P_System_Net_HttpWebRequest_ClientCertificates.htm
>
> All it really says is:
>
> HttpWebRequest.ClientCertificates Property
>
> Gets or sets the collection of security certificates that are
> associated with this request.
>
> It does not say that the certificate is used to sign the request.
> This implies to me that it simply passes the certificate verbatim in
> the request (as a header or something). As far as I understand,
> simply passing the certificate over the wire verbatim is not a valid
> way of authentication. Additionally, the book "Building Secure
> Microsoft ASP.NET Applications" from Microsoft Press did not clarify
> the question.
>
> After 4 days of googling on this topic and talking to various people
> at my company, I have come to the realization that this stuff is not
> widely understood. This is disconserting, because I think a security
> system needs to be understood by its owners, because otherwise how can
> they verify that it is indeed secure?
>
>
