How to Identify a User

This page describes the scenario of user identification. For example, how does a web site verify the user in web environment?

I separate the concept into 3 topics. First, we use the simplest but no efficient way to solve it. Second, we apply the digital signature way. Finally, we introduce secure boot that has the same concept.

Let's consider the use case. A client sends a request M1 to a server, and the server want to verify the M1 is sent by the the client. We can use asymmetric encryption/decryption to build a secure communication.

1. The client generates key pairs, public key (PubC) and private key (PrvC).
2. The client keeps PrvC and sends PubC to the server.
3. Before the client sends the request M1, it encrypt M1 with PrvC to get Cipher.
4. The client sends M1+Cipher to the server.
5. The server decrypt Cipher with PubC to get M.
6. The server compare M and M1. If both are same, the server make sure that M1 is owned by Client.

There is a problem that the RSA algorithm has bad performance for large data. We can apply digital signature to solve the performance.

We use Digest instead of Cipher. Digest is calculated by SHA algorithm for M1. The size of digest SHA-1 is 20 bytes. The size of digest SHA-256 is 32 bytes. The digest is too small so that we can use RSA to encrypt/decrypt it.

We can apply digital signature in secure boot, BIOS verifies if an OS loader is released by a OS vendor before running the OS loader. Before the OS vendor releases a version OS, the vendor signs the OS loader with private key and provides the public key to a BIOS vendor. Please refer the pages for the details of secure boot. The concept of secure boot comes from digital signature.

Explain the UEFI Secure Boot

How to Draw a Beautiful Flow Chart? (E.g., secure boot)

-Count