Guida compatta per costruire una PKI PQ-capable. → Dettagli: Scenari PKI

Root-CA (Offline, ML-DSA-87)
    └── Intermediate-CA (Online, ML-DSA-65)
            ├── Certificati Server (Hybrid: ECDSA + ML-DSA)
            ├── Certificati Client (ML-DSA-65)
            └── Certificati Utente (ML-DSA-65)

using var mlDsa = MlDsaSigner.Create(MlDsaParameterSet.MlDsa87);
 
var rootDn = new X500DistinguishedNameBuilder();
rootDn.AddCommonName("WvdS Root CA");
rootDn.AddOrganizationName("EMSR DATA d.o.o.");
 
var request = new CertificateRequest(rootDn.Build(), mlDsa, HashAlgorithmName.SHA512);
 
request.CertificateExtensions.Add(
    new X509BasicConstraintsExtension(true, true, 2, true));
request.CertificateExtensions.Add(
    new X509KeyUsageExtension(
        X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign, true));
 
var rootCert = request.CreateSelfSigned(
    DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(20));
 
File.WriteAllBytes("root-ca.pfx", rootCert.Export(X509ContentType.Pfx, "password"));

→ Dettagli: Creare Root-CA

var rootCert = new X509Certificate2("root-ca.pfx", "password");
using var mlDsa = MlDsaSigner.Create(MlDsaParameterSet.MlDsa65);
 
var dn = new X500DistinguishedNameBuilder();
dn.AddCommonName("WvdS Intermediate CA");
 
var csr = new CertificateRequest(dn.Build(), mlDsa, HashAlgorithmName.SHA384);
csr.CertificateExtensions.Add(new X509BasicConstraintsExtension(true, true, 0, true));
csr.CertificateExtensions.Add(
    new X509KeyUsageExtension(
        X509KeyUsageFlags.KeyCertSign | X509KeyUsageFlags.CrlSign, true));
 
var serial = new byte[20];
RandomNumberGenerator.Fill(serial);
serial[0] &= 0x7F;
 
var intCert = csr.Create(rootCert, DateTimeOffset.UtcNow,
    DateTimeOffset.UtcNow.AddYears(10), serial);

→ Dettagli: Creare Intermediate-CA

var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadWrite);
store.Add(new X509Certificate2("root-ca.crt"));
store.Close();

→ Dettagli: Configurare Trust Store

« ← Riferimento rapido | → Scenari PKI (Dettagli) »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional