Home

Table of Contents Pages Links Python & GPG Login certificates Python & OpenSSL

Pages

• Pictures

Links

• GPG Howto: http://www.gnupg.org/howtos/de/GPGMiniHowto-3.html
• Public key certificates: http://en.wikipedia.org/wiki/Public_key_certificate
• X.509 spec: http://www.itu.int/rec/T-REC-X.509-200811-I/en
• Python & Smartcards: http://ludovicrousseau.blogspot.de/2010/04/pcsc-sample-in-python.html
  • http://people.debian.org/~rousseau/smartcard.html

Python & GPG

• Summary: http://wiki.python.org/moin/GnuPrivacyGuard
• pygpgme: https://launchpad.net/pygpgme
• python-gnupg: http://code.google.com/p/python-gnupg/

Login certificates

Login certificates are PKCS #12 formatted files, containing a public certificate (public key + user identity), formatted as X.509, bundled with the corresponding private key. They can be used by the user's web browser to automatically authenticate a user at login, without the need for the user to enter a password.

Both, key and identity are verified in this process:

• server requests authentication
• browser sends public certificate
• server accepts the user, if the certificate itself is accepted or contains a signature from an accepted party, e.g. a CA
• server demands proof of private key ownership by sending a random "challenge" text
• browser proofs private key ownership by signing the challenge with the private key and sending the signature to the server
• login successfull

Generate using OpenSSL:

• http://support.citrix.com/article/CTX106630

Python & OpenSSL

• http://packages.python.org/pyOpenSSL/
  • PKCS #12 certificates: http://packages.python.org/pyOpenSSL/openssl-pkcs12.html