Definitions[]
PKI (an acronym for public key infrastructure)
| “ | [is] a system of hardware, software, policies, and people that can provide a set of information assurances (identification and authentication, confidentiality, data integrity, and nonrepudiation) that are important in conducting electronic transactions.[1] | ” |
| “ | [is] a set of policies, processes, server platforms, software and workstations used for the purpose of administering certificates and public-private key pairs, including the ability to issue, maintain, and revoke public key certificates."[2] | ” |
| “ | describes the hardware, software, people, policies, and procedures needed to create, manage, store, distribute, and revoke digital certificates. Public key infrastructure forms the foundation of the approach to V2V communications security by employing a 'public key' to authenticate a sender or encrypt data being sent in a message, thereby producing trusted and secure messages. A public key infrastructure typically involves a certificate authority that issues and verifies digital certificates, which includes the public key, a directory that holds the certificates and a certificate management and distribution system.[3] | ” |
Overview[]
The overall goals of modern security architectures are to protect and distribute information that is needed in a widely distributed environment, where the users, resources and stakeholders may all be in different places at different times. The emerging approach to address these security needs makes use of the scalable and distributed characteristics of public key infrastructure.
A public key infrastructure is one mechanism to support the binding of public keys with the user's identity. A PKI can provide the entire policy and technical framework for the systematic and diligent issuance, management and revocation of digital certificates, so that users who wish to rely on someone's certificate have a firm basis to check that the certificate has not been maliciously altered, and to confirm that it remains active (i.e., has not been revoked because of loss or compromise of the corresponding private key). This same infrastructure provides the basis for interoperability among different entities, so that a person's digital certificate can be accepted for transactions by organizations external to the one that issued it.
PKI allows one to conduct business electronically with the confidence that:
- The person or process identified as sending the transaction is actually the originator.
- The person or process receiving the transaction is the intended recipient.
- Data integrity has not been compromised.
Public key infrastructure is the combination of software, encryption technologies, and services that enables enterprises to protect the security of their communications and business transactions on networks.
PKI provide a desired level of trust using public key-based cryptographic techniques to generate and manage electronic “certificates.”[4] These certificates are used to link an individual or other entity to a public key that can be used to validate the information provided by the entity or individual or facilitate data encryption. Specifically, these certificates are used to verify digital signatures (providing authentication and data integrity) and facilitate data encryption (providing confidentiality). A properly designed and implemented PKI can also be used to ensure that a given digital signature is still properly linked to the individual or entity associated with it (providing nonrepudiation). A properly designed and implemented PKI can satisfy the criteria used to evaluate systems that produce electronic signatures.
In a small community where everyone knows everyone else, users can individually give their public keys to the people with whom they wish to deal. In a large-scale implementation, where it is necessary for individuals or entities that may not know each other to conduct transactions, it is impractical and unrealistic to expect that each user will have previously established relationships with all of the other potential users in order to obtain their public keys. One way around this problem is for all PKI users and relying entities to agree to trust a third party (known as a trusted third party or TTP) who is known to everyone.
The basic technical components for achieving third-party trust include (1) digital certificates, which link an individual to that user’s public key; (2) certification authorities, which create these certificates and vouch for their validity to the entities relying on the PKI; (3) registration authorities, which are in charge of verifying user identities so that the appropriate key pairs and digital certificates can be created; and (4) certification paths, which are used for recognizing and trusting digital certificates issued by other PKIs in order to create larger, connected networks of trust. In addition, a set of written policies establishes the security assurances that an organization needs to achieve and the practices and procedures that will be followed to achieve and maintain those assurances.
Potential problems[]
PKI is not without its issues. Most issues fall into two categories: First, a PKI can be complex to operate; and second, PKI policies are not globally understood.
References[]
- ↑ Technology Assessment: Cybersecurity for Critical Infrastructure Protection, at 178 n.13.
- ↑ Federal Public Key Infrastructure (full-text).
- ↑ Intelligent Transportation Systems: Vehicle-to-Vehicle Technologies Expected to Offer Safety Benefits, but a Variety of Deployment Challenges Exist, at 12 n.30.
- ↑ Additional information on public key cryptography and PKI issues can be found at GAO, Information Security: Advances and Remaining Challenges to Adoption of Public Key Infrastructure Technology (GAO-01-277) (Feb. 26, 2001).