Secure Electronic Commerce: Building the Infrastructure for Digital Signatures and Encryption Book

	Forewords	xv
	Preface	xxiii
Chapter 1	Introduction	1
1.1	The Upside	2
1.2	The Downside	3
1.3	E-Commerce Compared with Paper-Based Commerce	5
1.4	Making E-Commerce Secure	6
1.5	Book Road Map	8
Chapter 2	The Internet	11
2.1	Computer Networking	11
2.2	Internet Applications	16
2.3	The Internet Community	19
2.4	Internet Commerce	26
2.5	Example Transaction Scenarios	30
2.6	Summary	32
Chapter 3	Business and Legal Principles	39
3.1	The Electronic Commerce Transaction	40
3.2	Creating a Binding Commitment	41
3.3	Validity and Enforceability of Agreements	44
3.4	Enforcement	52
3.5	Other Legal Issues	56
3.6	Dealing with Legal Uncertainties	64
3.7	Two Business Models	67
3.8	Business Controls in a Digital Environment	69
3.9	Summary	70
Chapter 4	Information Security Technologies	93
4.1	Information Security Fundamentals	93
4.2	Introduction to Cryptography	101
4.3	Digital Signatures	109
4.4	Key Management	114
4.5	Authentication	120
4.6	System Trust	132
4.7	Summary	133
Chapter 5	Internet Security	141
5.1	Segmenting the Problem	141
5.2	Firewalls	146
5.3	IPsec and Virtual Private Networks	147
5.4	Web Security with SSL/TLS	152
5.5	Other Web Security Protocols	157
5.6	Secure Messaging and S/MIME	160
5.7	Other Messaging Security Protocols	167
5.8	Secure Payments on the Internet	168
5.9	Summary	173
Chapter 6	Certificates	181
6.1	Introduction to Public-Key Certificates	181
6.2	Public-Private Key-Pair Management	187
6.3	Certificate Issuance	191
6.4	Certificate Distribution	196
6.5	X.509 Certificate Format	198
6.6	Certificate Revocation	216
6.7	X.509 Certificate Revocation List	226
6.8	Key-Pair and Certificate Validity Periods	235
6.9	Certificate Formats Other than X.509	238
6.10	Certification of Authorization Information	238
6.11	Summary	243
Chapter 7	Public-Key Infrastructure	251
7.1	PKI for the Typical E-Commerce Enterprise	251
7.2	Certification Authority Structures: Traditional Models	253
7.3	Certification Authority Structures: The Generalized Model	259
7.4	Certificate Policies	263
7.5	Name Constraints	269
7.6	Certificate Management Protocols	271
7.7	PGP's Web of Trust	275
7.8	Some Multienterprise PKI Examples	277
7.9	Pragmatics of PKI Interoperation and Community Building	284
7.10	Summary	285
Chapter 8	Legislation, Regulation, and Guidelines	289
8.1	General E-Commerce Legislation and Regulation	290
8.2	Digital Signature Laws	302
8.3	General E-Commerce Guidelines	310
8.4	PKI-Related Standards and Guidelines	311
8.5	Summary	317
Chapter 9	Non-repudiation	333
9.1	Concept and Definition	333
9.2	Types of Non-repudiation	337
9.3	Activities and Roles	342
9.4	Mechanisms for Non-repudiation of Origin	346
9.5	Mechanisms for Non-repudiation of Delivery	351
9.6	Trusted Third Parties	353
9.7	Dispute Resolution	361
9.8	Summary	365
Chapter 10	Certification Policies and Practices	385
10.1	Concepts	385
10.2	CP and CPS Topics: Introduction of a CP or CPS	393
10.3	CP and CPS Topics: General Provisions	395
10.4	CP and CPS Topics: Identification and Authentication	404
10.5	CP and CPS Topics: Operational Requirements	407
10.6	CP and CPS Topics: Physical, Procedural, and Personnel Security Controls	414
10.7	CP and CPS Topics: Technical Security Controls	416
10.8	CP and CPS Topics: Certificate and CRL Profiles	418
10.9	CP and CPS Topics: Specification Administration	419
10.10	Systematizing CP and CPS Development	420
10.11	Summary	421
Chapter 11	Public-Key Infrastructure Assessment and Accreditation	433
11.1	The Role of Assessment in Public-Key Infrastructure	434
11.2	Evolution of Information System Assessment Criteria	442
11.3	Noteworthy Assessment and Accreditation Schemes	447
11.4	Rationalization of Assessment Schemes	459
11.5	Summary	460
Appendix A	Forms of Agreement	471
Appendix B	The U.S. Federal E-Sign Act	489
Appendix C	ASN.1 Notation	503
Appendix D	X.509 in ASN.1 Notation	511
Appendix E	United Nations Model Law on Electronic Commerce	541
Appendix F	How to Obtain Referenced Documents	551
Appendix G	Legacy Application Security Standards	555
Appendix H	PKI Disclosure Statement	561
Appendix I	Repudiation In Law	563
Appendix J	Public-Key Cryptosystems	569
Appendix K	European Signature Directive	589
	Index	595