From: Nikos Mavrogiannopoulos Date: Fri, 14 Jun 2002 21:14:17 +0000 (+0000) Subject: *** empty log message *** X-Git-Tag: gnutls_0_5_0~91 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=72ce9a86683e7e329ae8f2a72bf93e86da0ec0ab;p=thirdparty%2Fgnutls.git *** empty log message *** --- diff --git a/doc/tex/Makefile.am b/doc/tex/Makefile.am index 1f10c1c73c..ec1e265e49 100644 --- a/doc/tex/Makefile.am +++ b/doc/tex/Makefile.am @@ -6,10 +6,10 @@ TEX_OBJECTS = gnutls.tex ../../lib/gnutls-api.tex serv1.tex ex1.tex ex2.tex ex3. macros.tex cover.tex ciphersuites.tex handshake.tex translayer.tex \ auth.tex ciphers.tex errors.tex layers.tex alert.tex record.tex \ funcs.tex examples.tex ex4.tex ../../libextra/gnutls-extra-api.tex \ - memory.tex intro.tex openpgp.tex + memory.tex intro.tex openpgp.tex x509.tex gnutls.html: $(TEX_OBJECTS) - -latex2html gnutls.tex -no_navigation -no_subdir 1 -split 0 \ + -latex2html gnutls.tex -no_navigation -split 0 \ -local_icons -html_version 3.2,math -info "" -white gnutls.ps: $(TEX_OBJECTS) diff --git a/doc/tex/auth.tex b/doc/tex/auth.tex index 8e6375b1af..7f3a99ee72 100644 --- a/doc/tex/auth.tex +++ b/doc/tex/auth.tex @@ -7,30 +7,8 @@ The following authentication schemas are supported in \gnutls: \item SRP authentication \end{enumerate} -\section{Authentication using X.509 certificates} -This authentication method is part of the certificate authentication -method in \gnutls{}. -The X.509 protocols rely on a hierarchical trust model. In this trust model -Certification Authorities (CAs) are used to certify entities. -Usually more than one certification authorities exist, and certification -authorities may certify other authorities to issue certificates as well, -following a hierachical model. -One needs to trust one or more CAs for his secure -communications. In that case only the certificates issued by the trusted -authorities are acceptable. -\par -X.509 certificates contain the public parameters, -of a public key algorithm, and the authority's signature, which proves the -authenticity of the parameters. -\par -The key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are -available in X.509 authentication. - -\par -Note that \gnutls{} is not a generic purpose X.509 toolkit\footnote{Aegypten is such a toolkit. See -\htmladdnormallink{http://www.gnupg.org/aegypten/}{http://www.gnupg.org/aegypten/}}. -\gnutls{} only includes the required, -in order to use the TLS ciphersuites which require X.509 certificates. +% x.509 section +\input{x509} \begin{figure}[hbtp] \begin{tabular}{|l|p{9cm}|} @@ -56,10 +34,8 @@ parameters which are send to the peer. \end{figure} -\section{Authentication using OpenPGP keys} -This authentication method is part of the certificate authentication -method in \gnutls{}. All the key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are -available in OpenPGP authentication. + +% openpgp section \input{openpgp} diff --git a/doc/tex/macros.tex b/doc/tex/macros.tex index cec64c5836..403e062833 100644 --- a/doc/tex/macros.tex +++ b/doc/tex/macros.tex @@ -7,8 +7,9 @@ \newcommand{\ssl}{{\emph{SSL}}} \newcommand{\HRule}{\rule{\linewidth}{0.4mm}} + % accepts section name, function name \newcommand{\printfunc}[2]{% - \hyperref{#2}{#2 (see Section }{)}{#1} + \hyperref{#2}{#2 (see section }{ p. \pageref{#1})}{#1} } diff --git a/doc/tex/openpgp.tex b/doc/tex/openpgp.tex index 8431449adf..e51dd57695 100644 --- a/doc/tex/openpgp.tex +++ b/doc/tex/openpgp.tex @@ -1,3 +1,8 @@ +\section{Authentication using OpenPGP keys} +This authentication method is part of the certificate authentication +method in \gnutls{}. All the key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are +available in OpenPGP authentication. + \subsection{The OpenPGP trust model in \gnutls{}} \label{sec:pgp} diff --git a/doc/tex/x509.tex b/doc/tex/x509.tex new file mode 100644 index 0000000000..b41d500b42 --- /dev/null +++ b/doc/tex/x509.tex @@ -0,0 +1,49 @@ +\section{Authentication using X.509 certificates} + +This authentication method is part of the certificate authentication +method in \gnutls{}. +The X.509 protocols rely on a hierarchical trust model. In this trust model +Certification Authorities (CAs) are used to certify entities. +Usually more than one certification authorities exist, and certification +authorities may certify other authorities to issue certificates as well, +following a hierachical model. +One needs to trust one or more CAs for his secure +communications. In that case only the certificates issued by the trusted +authorities are acceptable. +\par +X.509 certificates contain the public parameters, +of a public key algorithm, and the authority's signature, which proves the +authenticity of the parameters. +\par +The key exchange methods shown in \hyperref{figure}{figure }{}{fig:cert} are +available in X.509 authentication. + +\par The use of X.509 certificates requires some functions which will +assist in parsing them. \gnutls{} includes functions which extract +parameters from given X.509 certificates. Some of them are: +\begin{itemize} +\item \printfunc{gnutls_x509_extract_certificate_dn}{gnutls\_x509\_extract\_certificate\_dn} +\item \printfunc{gnutls_x509_extract_certificate_serial}{gnutls\_x509\_extract\_certificate\_serial} +\item \printfunc{gnutls_x509_extract_certificate_subject_alt_name}{gnutls\_x509\_extract\_certificate\_subject\_alt\_name} +\end{itemize} + +Given the complexity of the X.509 protocols we do not expect these limited +functions to cover every need. Thus a function which exports X.509 certificates +to an XML form is provided. See +\printfunc{gnutls_x509_get_certificate_xml}{gnutls\_x509\_get\_certificate\_xml}. + +\par +Verifying certificate paths is also important in X.509 authentication. +For this purpose you can use the +\printfunc{gnutls_x509_verify_certificate}{gnutls\_x509\_verify\_certificate} +function. A more generic one is also provided and can be used with all +of the certificate authentication methods, but is limited to a session. See the +\printfunc{gnutls_certificate_verify_peers}{gnutls\_certificate\_verify\_peers} +function. + +\par +Note that \gnutls{} is not a generic purpose X.509 toolkit\footnote{Aegypten is such a toolkit. See +\htmladdnormallink{http://www.gnupg.org/aegypten/}{http://www.gnupg.org/aegypten/}}. +\gnutls{} only includes the required, +in order to use the TLS ciphersuites which require X.509 certificates. +