1、 KSKSKSKSKSKSKSK KSKSKS KSKSK KSKS KSK KS KS A ISO 26430 2 (D- ) 2： KS A ISO 26430 2:2010 2010 12 28 http:/www.kats.go.krKS A ISO 26430 2:2010 : ( ) ( ) ( ) : (http:/www.standard.go.kr) ： ：2010 12 28 2010-0661 ： ： ( 02-509-7278) (http:/www.kats.go.kr). 10 5 , . KS A ISO 26430 2:2010 i .1 1 1 2 1 3 2
2、 4 ( ) .2 5 .3 5.1 3 5.2 4 5.3 5 5.4 (Certificate) (Public Key Thumbprint) 7 6 7 6.1 7 6.2 8 6.3 ( )10 A( ) CommonName .11 B( ) 13 C( ) 15 D( ) 16 1 X.509V3 .3 2 .4 3 X.509 .5 A.1 11 KS A ISO 26430 2:2010 (D- ) 2： Digital cinema(D-cinema) operations Part 2： Digital certificate 2008 1 ISO 26430 2, Di
3、gital cinema(D-cinema) operations Part 2：Digital certificate , . 1 . , . . (： TLS) - (application-messaging) ETM Composition Play List(CPL) Packing List(PL) X.509v3X.509 . X.509v3 , X.509v3 . X.509v3 . 2 . . ( ) . ASN.1 ISO/IEC 8824 1： 2002(ITU-T X.680, Information Technology) Abstract Syntax Notati
4、on One(ASN.1). See： http:/www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=35684 Base64 MIME(Multipurpose Internet Mail Extensions) Part One： Mechanisms for Specifying and Describing the Format of Internet Message Bodies. See： http:/www.ietf.org/rfc/rfc1521.txt FIPS 180 2 “Secure Hash
5、 Standard” Version 2. August 1, 2002. FIPS-180-2. http:/csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf PKCS1 “PKCS #1： RSA Encryption Version 2.1” By B. Kaliski. February 2003. IETF RFC 3447 See：KS A ISO 26430 2:2010 2 http:/www.ietf.org/rfc/rfc3447.txt RFC4055 “Additional Algorithms and Id
6、entifiers for RSA Cryptography for Use in the Internet X.509 Public Key Infrastructure” by J. Schaad, B. Kalisky, R. Housley, June 2005. See ：http:/ietf.org/rfc/rfc4055.txt RFC3280 “Internet X.509 Public Key Infrastructure Certificate and CRL Profile” by R. Housley, W. Ford, W. Polk, D. Solo, April
7、2002. See： http:/ietf.org/rfc/rfc3280.txt Time UTC, RFC 3339： Date and Time on the Internet： Timestamps. G. Klyne and C. Newman. Informational, July 2002. See： http:/ietf.org/rfc/rfc3339.txt X.509 ITU-T Recommendation X.509(1997 E) ： Information Technology Open Systems Interconnection The Directory：
8、 Authentication Framework, June 1997. See： http:/www.itu.int/ITU-T/ans1/database/itu-t/x/x509/1997/ 3 . ASN.1(Abstract Syntax Notation.1)： 1 BER(Basic Encoding Rules for ASN.1)： Base64(A printable encoding of binary data)： 2 (Base64 .) CA(Certificate Authority)： DC(Digital Cinema)： DER(Distinguished
9、 Encoding Rules for ASN.1)： ETM(Extra Theatre Message)： FIPS(Federal Information Processing Standards of NIST)： NIST IETF(Internet Engineering Task Force Standards group)： IP(Internet Protocol)： . IETF ISO(International Standards Organization)： LE(Link Encryptor)： LD(Link Decryptor)： MD(Media Decryp
10、tor)： NIST(National Institute of Standards and Technologies)： RO(Right Owner)： RSA(Rivest Shamir Adleman public key algorithm)： SE(Security Entity)： . SHA-1(Secure Hash Algorithm revision 1)： 1. FIPS-180-2 SHA-256(Secure Hash Algorithm with 256 bits)： . FIPS-180-2 SM(Security Manager)： S/MIME(Secure
11、 Multipurpose Internet Mail Extension)： SPB(Secure Processing Block)： SSL(Secure Socket Layer)： . TLS TCP(Transmission Control Protocol)： TLS(Tansport Layer Security Protocol)： . Rescorla TMS(Theatre Management System)： X.509： XML(Extensible Markup Language)： 4 ( ) KS A ISO 26430 2:2010 3 , . , . ,
12、, , , . . . 1 “ (root)” ( ), . ( ) . , . ( ) . . , . 5 X.509(version 3)(X.509 ) . X.509 , . . 5.1 . . 1 . ASN.1 DER(ASN.1,Kaliski ) . 1 X.509v3 ( ). SignatureAlgorithm . . SignatureValue . SubjectPublicKeyInfo “ ” . Version X.509 version 3 . SerialNumber Signature (signature algorithm) . SignatureAl
13、gorithm . Issuer Subject , KS A ISO 26430 2:2010 4 1 X.509v3 ( ) Validity / SubjectPublicKeyInfo . , , RSA , . AuthorityKeyIdentifier KeyUsage (flag bit) . , . BasicConstraint , . . . 5.2 2 . 2 X.509 SignatureAlgorithm Sha256WithRSAEncryption . v1.5 (signaturepadding)(PKCS #1 ) RSA , SHA-256(FIPS-18
14、0-2 ) .SignatureValue PKCS #1 ASN.1 . SHA-256WithRSA (RFC4055 ) . Version X.509 version 3 . SerialNumber . 64 (unsigned integer value) . Signature Sha-256WithRSAEncryption . Issuer , . . Subject . . Validity 2049 UTCTime( ) . 2050 GeneralizedTime( ) (Time). SubjectPublicKeyInfo RSA . RSA 2048 . 6553
15、7 . . , . KS A ISO 26430 2:2010 5 2 ( ) X.509 AuthorityKeyIdentifier AuthorityCertIssuer AuthorityCertSerialNumber . . , . KeyUsage . , KeyCertSign . DigitalSignature KeyEncipherment . .BasicConstraint . CA . CA , PathLenConstraint 0 . 6.2.5 5.3 . , . X.509 , 3 X.509 . . 3 X.509 X.509 (Public Key Th
16、umbprint) DnQualifier (thumbprint) (n/a) CountryName X.509 . (Root Name) OrganizationName (Organization Name) OrganizationUnitName . . (Entity Name) CommonName . Entity Name 5.3.1 (Public Key Thumbprint)(DnQualifier) DnQualifier . 5.4 (Public Key Thumbprint) Base64 PrintableString . DnQualifier . Dn
17、Qualifier ( KS A ISO 26430 2:2010 6 ). . 5.3.2 (Root Name)(OrganizationName) . . OrganizationName PrintableString . . . OrganizationName OrganizationName . OrganizationName . OrganizationName . . , . , . . , “DC.CA.BigBlue.Com” “BigBlue.Com” . . 5.3.3 (Organization Name)(OrganizationUnitName) Organi
18、zationUnitName , PrintableString . , OrganizationUnitName . , . OrganizationUnitName , CommonName . OrganizationUnitName . 5.3.4 (Entity Name) (CommonName) PrintableString . , ( , , ) . ( A ). (“.”) , (52 ) . ( A ) . . ： (exhibition) . , “.” . KS A ISO 26430 2:2010 7 5.4 (Certificate) (Public Key Th
19、umbprint) , . SubjectPublicKeyInfo (BIT STRING) SHA-1 (hash)(FIPS-180-2 ) ( DER DER , , ). RFC3280 4.2.1.2 1 . DnQualifier , Base64 (Base64 ). (Certificate Thumbprint) SHA-1 , DER To-Be-Signed SHA-1 . (Certificate Thumbprint) Base64 (Base64 ). (Certificate Thumbprint) SHA-1 . SHA-256 . 6 . . . . 6.1
20、 . . . a) b) ( ) c) d) ( ) e) f) (issuerName-serialNumber pairs) g) 6.2 . . KS A ISO 26430 2:2010 8 a) 16, 17, 18, 19 b) 16 c) 8 d) 9 e) 19 f) 12 g) 12 , , , . . A . 6.2 . . ( 64 , , . . 1. ASN.1 DER . DER DER , . BER . 2. Version X.509v3 . 3. Critical . 4. . 5. BasicConstraint CA , PathLenConstraint , 0 . . BasicConstraint CA , PathLenConstraint 0 . . 6. KeyUsage . BasicConstraint CA , KeyCertSign cRLsign . , DigitalSignature KeyEncipherment . . 7. OrganizationName , . . 8. (BasicConstraint CA ), CommonName (： KS A ISO 26430 2:2010 9 BasicConstraint True ,
