Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual page 514

Appendix B. Introduction to Public-Key Cryptography
not sent across the network, and allows the administrator to control user authentication centrally. This
is called single sign-on.
Figure B.5, "Using a Certificate to Authenticate a Client to a Server"
works using certificates and SSL. To authenticate a user to a server, a client digitally signs a randomly
generated piece of data and sends both the certificate and the signed data across the network. The
server authenticates the user's identity based on the data in the certificate and signed data.
Figure B.4, "Using a Password to Authenticate a Client to a
Like
Certificate to Authenticate a Client to a Server"
and requested a resource and that the server has requested client authentication before granting
access to the requested resource.
Figure B.5. Using a Certificate to Authenticate a Client to a Server
Unlike the authentication process in
Server", the authentication process in
a Server"
requires SSL.
assumes that the client has a valid certificate that can be used to identify the client to the server.
Certificate-based authentication is preferred to password-based authentication because it is based on
the user both possessing the private key and knowing the password. However, these two assumptions
are true only if unauthorized personnel have not gained access to the user's machine or password,
the password for the client software's private key database has been set, and the software is set up to
request the password at reasonably frequent intervals.
NOTE
Neither password-based authentication nor certificate-based authentication address
security issues related to physical access to individual machines or passwords. Public-
key cryptography can only verify that a private key used to sign some data corresponds to
the public key in a certificate. It is the user's responsibility to protect a machine's physical
security and to keep the private-key password secret.
492
Figure B.4, "Using a Password to Authenticate a Client to a
Figure B.5, "Using a Certificate to Authenticate a Client to
Figure B.5, "Using a Certificate to Authenticate a Client to a Server"
shows how client authentication
Server",
assumes that the user has already trusted the server
Figure B.5, "Using a
also