PKI 基础理论-2
Digital signatures operate in two distinct functions: signature construction and signature
verification. Following are the steps in signature construction:
数字签名有两个截然不同的功能：签名构建和签名验证：将message先hash，然后用自己的私钥做加密，这里并没有CIA和不可否认性的C。
signature construction 签名构建
1. A message is created by the sender.
2. A hash is taken of that message.
3. That hash is encrypted with the sender’s private key.
4. The encrypted hash, the digital signature, is sent with the original message.
————————————————————————————————————————————————
Following are the steps in signature verification:签名验证
1. The encrypted hash is separated from the original message.
2. A hash is taken of the original message.
3. The encrypted hash is decrypted with the sender’s private key.
4. The decrypted hash is compared with the hash of the original message.
5. If both hashes are the same, the signature, and consequently the sender’s identity, is verified.
————————————————————————————————————————————————
In summary, a digital signature is the hash of a message, which is encrypted with the sender’s private key. The signature must be verified to verify the sender’s identity. This is done by the receiver, who decrypts the signature with the sender’s public key, makes a hash of the original message, and compares both hashes. If both are the same, the sender’s identity is verified
通过上诉两个图片可以看出：当一个message 先hash，然后用发送者得私钥进行加密，那么这个数字签名怎么进行检查，接收者用发送者得公钥进行解密，得到一个hash值。原始的message 由接收者做hash，此时得到两个hash值，比较两个hash值是否相同。如果相同，那么发送者的身份就得到确认。问题是message是什么？通过message就认为你没有问题了吗
————————————————————————————————————————————————
Authentication occurs in Phase 1 of IKE; consequently, we focus on Phase 1. 认证发生在IKE的第一阶段，所以我们关注IKE的第一阶段，authentication both peer 是怎么发生的。这里不再讨论使用pre-share key 。
both sender and receiver have received a certificate from the same certification authority (CA). both the sender and receiver have a copy of the CA’s public key.
当我们在构建PKI架构的时候，通常在实体上安装CA的数字证书，那么这个CA的证书实际上就是CA的公钥;
————————————————————————————————————————————————
At a high level, certificate authentication can involve verifying digital signatures. The digital signature of the IKE peer is verified. Also, the digital signature of the CA is verified to ensure the certificate provided by the authenticator has truly been issued by the CA. For the peer to receive a certificate from the CA, the peer must first have a public private key pair (typically RSA). This key pair is signed by the CA and used as part of the digital signature offered by the peer described later in this chapter.
在一个高的层面，CA是参与数字签名的。IKE peer 的数字签名是被检查的，也就是说，CA的数字签名是被检查以确保证书是被信任的CA提供的。实体从CA收到证书，那么实体先要用RSA产生一个密钥对。这个密钥对是被CA签名，并且这个密钥对被使用作为实体提供数字签名的一部分。也就是说实体先产生一个密钥对（密钥对的产生是基于非对称密钥算法的RSA），然后实体向CA提交的message里面，至少包含了实体自己的密钥对。。。然后CA用自己的私钥向这个message做加密，从而产生数字签名。
理论研究中，各种角色已经纷纷登场：包含了CA,在层面的最顶端，数字证书，数字签名，非对称密钥算法RSA，以及他们的大体作用。当然还不是那么清晰。。。