Updated documentation.

diff --git a/doc/tex/auth.tex b/doc/tex/auth.tex
index 7104a34939f6b8e2fd2619d6a1e0e7b38b75d363..d6d9f69df17d218c2135702d6a58d2a26af5b3d9 100644 (file)
--- a/doc/tex/auth.tex
+++ b/doc/tex/auth.tex
@@ -2,19 +2,33 @@
 \par
 The following authentication schemas are supported in \gnutls:
 \begin{enumerate}
- \item X509 Public Key Infrastructure
+ \item X.509 Public Key Infrastructure
+ \item OpenPGP Public Key Infrastructure
  \item Anonymous authentication
  \item SRP authentication
 \end{enumerate}
 
 \subsection{Authentication using X.509 certificates}
-If using this kind of authentication then the key exchange methods
-shown in \hyperref{figure}{figure }{}{fig:x509} are
-available to use. Authentication in this method is performed using signed
-certificates by a trusted Certificate Authority (CA). Note that \gnutls is
-not a generic purpose X.509 toolkit\footnote{Aegypten is such a toolkit. See 
+The X.509 protocols rely on a hierarchical trust model. In this trust model
+Certification Authorities (CAs) are used to certify entities.
+Usually more than one certification authorities exist, and certification
+authorities may certify other authorities to issue certificates as well,
+following a hierachical model. 
+One needs to trust one or more CAs for his secure
+communications. In that case only the certificates issued by the trusted
+authorities are acceptable. 
+\par
+X.509 certificates contain the public parameters, 
+of a public key algorithm, and the authority's signature, which proves the
+authenticity of the parameters.
+\par
+The key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are
+available in X.509 authentication. 
+
+\par
+Note that \gnutls{} is not a generic purpose X.509 toolkit\footnote{Aegypten is such a toolkit. See 
 \htmladdnormallink{http://www.gnupg.org/aegypten/}{http://www.gnupg.org/aegypten/}}. 
-It does only include the required,
+\gnutls{} only includes the required,
 in order to use the TLS ciphersuites which require X.509 certificates.
 
 \begin{figure}[hbtp]
@@ -26,7 +40,10 @@ The certificate must allow the key to be used for encryption.
 \hline
 DHE\_RSA & The RSA algorithm is used to sign Ephemeral Diffie Hellman
 parameters which are send to the peer. The key in the certificate must allow
-the key to be used for signing 
+the key to be used for signing. Note that key exchange algorithms which use
+Ephemeral Diffie Hellman parameters, offer perfect forward secrecy, which
+means that even if the secret key is revealed the contents of this connection
+will not be available.
 \\
 \hline
 DHE\_DSS & The DSS\footnote{DSS stands for Digital Signature Standard} algorithm is used to sign Ephemeral Diffie Hellman
@@ -35,11 +52,24 @@ parameters which are send to the peer. Currently \gnutls does not support this c
 \hline
 \end{tabular}
 
-\caption{Supported X.509 key exchange algorithms}
-\label{fig:x509}
+\caption{Key exchange algorithms for OpenPGP and X.509 certificates.}
+\label{fig:cert}
 
 \end{figure}
 
+\subsection{Authentication using OpenPGP keys}
+OpenPGP authentication relies on a distributed trust model, called the "web
+of trust". The "web of trust" uses a decentralized system of trusted
+introducers, which are the same as a CA. OpenPGP allows anyone to sign
+anyone's else public key. When Alice signs Bob's key, she is introducing 
+Bob's key to anyone who trusts Alice. If someone trusts Alice to introduce
+keys, then Alice is a trusted introducer in the mind of that observer.
+\par
+
+The key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are
+available in OpenPGP authentication. 
+
+
 \subsection{Anonymous authentication}
 The anonymous key exchanges perform encryption but there is no indication of the 
 identity of the peer. This kind of authentication is vulnerable to man in the middle attack, 

diff --git a/doc/tex/ciphersuites.tex b/doc/tex/ciphersuites.tex
index d89f9f488884b18b810f9d75b68b2ac648366b8c..e7f1791d7d92704d32bf70f1920874cc4aa90e4b 100644 (file)
--- a/doc/tex/ciphersuites.tex
+++ b/doc/tex/ciphersuites.tex
@@ -1,7 +1,7 @@
 \newpage
 \section{TLS Cipher suites}
 \par 
-\tlsI supports ciphersuites like {\bf TLS\_DHE\_RSA\_WITH\_3DES\_CBC\_SHA}.
+\tlsI{} supports ciphersuites like {\bf TLS\_DHE\_RSA\_WITH\_3DES\_CBC\_SHA}.
 These ciphersuites contain three parameters:
 \begin{itemize}
 \item The key exchange algorithm (DHE\_RSA in the example)

diff --git a/doc/tex/cover.tex.in b/doc/tex/cover.tex.in
index 430ef19f30df1a6873c38c7a426610d17fc0b1ac..58b7113ffc0e775caa45f81f50bdcd23b1153c46 100644 (file)
--- a/doc/tex/cover.tex.in
+++ b/doc/tex/cover.tex.in
@@ -26,8 +26,6 @@ This document applies to GnuTLS @VERSION@
 
 \vspace*{\stretch{2}}
 
-{\Large By Nikos Mavroyanopoulos and Fabio Fiorina}
-\vspace{-.2cm}
 \\
 \HRule
 

diff --git a/doc/tex/gnutls.tex b/doc/tex/gnutls.tex
index 6cab612f21b36f684d0caaa9feaeae269a80594b..581f6aa5fbefe14400af41be47cae9b66b358354 100644 (file)
--- a/doc/tex/gnutls.tex
+++ b/doc/tex/gnutls.tex
@@ -47,17 +47,18 @@ Currently \gnutls{} implements:
 There are ciphersuites in \tlsI{} that are considered weak. These
 ciphersuites are deliberately weak in order to be able to export encryption
 software from some countries.}
- \item {\bf X.509} Public Key Infrastructure (with several limitations).
+ \item {\bf X.509} Public Key Infrastructure.
+ \item {\bf OpenPGP} Public Key Infrastructure.
  \item {\bf SRP} for \tls{} authentication.
- \item \tls{} {\bf Extension mechanism}
+ \item \tls{} {\bf Extension mechanism}.
 \end{itemize}
 
 \input{ciphersuites}
 
-\input{ciphers}
-
 \input{auth}
 
+\input{ciphers}
+
 \input{resumedb}
 
 \input{translayer}