macros.tex cover.tex ciphersuites.tex handshake.tex translayer.tex \
auth.tex ciphers.tex errors.tex layers.tex alert.tex record.tex \
funcs.tex examples.tex ex4.tex ../../libextra/gnutls-extra-api.tex \
- memory.tex intro.tex openpgp.tex
+ memory.tex intro.tex openpgp.tex x509.tex
gnutls.html: $(TEX_OBJECTS)
- -latex2html gnutls.tex -no_navigation -no_subdir 1 -split 0 \
+ -latex2html gnutls.tex -no_navigation -split 0 \
-local_icons -html_version 3.2,math -info "" -white
gnutls.ps: $(TEX_OBJECTS)
\item SRP authentication
\end{enumerate}
-\section{Authentication using X.509 certificates}
-This authentication method is part of the certificate authentication
-method in \gnutls{}.
-The X.509 protocols rely on a hierarchical trust model. In this trust model
-Certification Authorities (CAs) are used to certify entities.
-Usually more than one certification authorities exist, and certification
-authorities may certify other authorities to issue certificates as well,
-following a hierachical model.
-One needs to trust one or more CAs for his secure
-communications. In that case only the certificates issued by the trusted
-authorities are acceptable.
-\par
-X.509 certificates contain the public parameters,
-of a public key algorithm, and the authority's signature, which proves the
-authenticity of the parameters.
-\par
-The key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are
-available in X.509 authentication.
-
-\par
-Note that \gnutls{} is not a generic purpose X.509 toolkit\footnote{Aegypten is such a toolkit. See
-\htmladdnormallink{http://www.gnupg.org/aegypten/}{http://www.gnupg.org/aegypten/}}.
-\gnutls{} only includes the required,
-in order to use the TLS ciphersuites which require X.509 certificates.
+% x.509 section
+\input{x509}
\begin{figure}[hbtp]
\begin{tabular}{|l|p{9cm}|}
\end{figure}
-\section{Authentication using OpenPGP keys}
-This authentication method is part of the certificate authentication
-method in \gnutls{}. All the key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are
-available in OpenPGP authentication.
+
+% openpgp section
\input{openpgp}
\newcommand{\ssl}{{\emph{SSL}}}
\newcommand{\HRule}{\rule{\linewidth}{0.4mm}}
+
% accepts section name, function name
\newcommand{\printfunc}[2]{%
- \hyperref{#2}{#2 (see Section }{)}{#1}
+ \hyperref{#2}{#2 (see section }{ p. \pageref{#1})}{#1}
}
+\section{Authentication using OpenPGP keys}
+This authentication method is part of the certificate authentication
+method in \gnutls{}. All the key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are
+available in OpenPGP authentication.
+
\subsection{The OpenPGP trust model in \gnutls{}}
\label{sec:pgp}
--- /dev/null
+\section{Authentication using X.509 certificates}
+
+This authentication method is part of the certificate authentication
+method in \gnutls{}.
+The X.509 protocols rely on a hierarchical trust model. In this trust model
+Certification Authorities (CAs) are used to certify entities.
+Usually more than one certification authorities exist, and certification
+authorities may certify other authorities to issue certificates as well,
+following a hierachical model.
+One needs to trust one or more CAs for his secure
+communications. In that case only the certificates issued by the trusted
+authorities are acceptable.
+\par
+X.509 certificates contain the public parameters,
+of a public key algorithm, and the authority's signature, which proves the
+authenticity of the parameters.
+\par
+The key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are
+available in X.509 authentication.
+
+\par The use of X.509 certificates requires some functions which will
+assist in parsing them. \gnutls{} includes functions which extract
+parameters from given X.509 certificates. Some of them are:
+\begin{itemize}
+\item \printfunc{gnutls_x509_extract_certificate_dn}{gnutls\_x509\_extract\_certificate\_dn}
+\item \printfunc{gnutls_x509_extract_certificate_serial}{gnutls\_x509\_extract\_certificate\_serial}
+\item \printfunc{gnutls_x509_extract_certificate_subject_alt_name}{gnutls\_x509\_extract\_certificate\_subject\_alt\_name}
+\end{itemize}
+
+Given the complexity of the X.509 protocols we do not expect these limited
+functions to cover every need. Thus a function which exports X.509 certificates
+to an XML form is provided. See
+\printfunc{gnutls_x509_get_certificate_xml}{gnutls\_x509\_get\_certificate\_xml}.
+
+\par
+Verifying certificate paths is also important in X.509 authentication.
+For this purpose you can use the
+\printfunc{gnutls_x509_verify_certificate}{gnutls\_x509\_verify\_certificate}
+function. A more generic one is also provided and can be used with all
+of the certificate authentication methods, but is limited to a session. See the
+\printfunc{gnutls_certificate_verify_peers}{gnutls\_certificate\_verify\_peers}
+function.
+
+\par
+Note that \gnutls{} is not a generic purpose X.509 toolkit\footnote{Aegypten is such a toolkit. See
+\htmladdnormallink{http://www.gnupg.org/aegypten/}{http://www.gnupg.org/aegypten/}}.
+\gnutls{} only includes the required,
+in order to use the TLS ciphersuites which require X.509 certificates.
+
projects / thirdparty / gnutls.git / commitdiff
