![]() |
Common-use signing interface help
|
||
|
Overview of Keys and Certificates
The CSI relies on public key infrastructure (PKI) to secure electronic transactions that traverse the Internet between businesses and government agencies. This technology provides a secure means of authenticating the business or government agency to the alternate party, and for protecting the integrity and confidentiality of the communications. At the heart of PKI technologies lies the use of digital certificates and keys. These are the data components issued to individuals or organisations that enable them to identify themselves digitally, and to perform operations restricted to the specified entity such as the digital signing or decryption of a transaction. Certificates hold two keys. One key is the "private" component of the pair, and is protected using a password and/or by storing it on a smart card. Private keys need to safeguarded and should not be made available to anybody except the individual to whom they have been issued. The other key is the "public" key which can be freely distributed to other people and is used to verify messages signed by your private key. Your public key can also be used by other people to encrypt messages that are subsequently sent to you and then decrypted using your private key. Along with keys, certificates contain some basic information about an individual or organisation, including the name, organisation details, and the Australian Business Number (ABN), as well as the technical information required, for example, to verify a digital signature generated by the corresponding key. Certificates themselves are digitally signed by a trusted entity, known as a Certificate Issuing Authority or Certification Authority, to protect the integrity of the contained data. This entity is responsible for verifying your identity before issuing you with a set of keys and certificates. As an ABN-DSC subscriber you have most likely been issued with two certificates, although these may be stored on the same smart card or in the same password-protected software file. In most cases one of these certificates is used for digital signatures and the other for encryption. You can see both these certificates using the "View certificates" button in the CSI management utility. When signing a transaction the "authentication" certificate will be used. Sometimes depending on the transaction type the "non-repudiation" certificate will be used. The authentication and non-repudiation certificates are often one and the same certificate. The difference between the two types of signing operations is that a what-you-see-is-what-you-sign (WYSIWYS) screen is displayed to the user the show exactly what information they are signing for non-repudiation. Authentication signing does not show the WYSIWYS screen but the operation performed is identical. |