Public Key Infrastructure

Abstract

This paper is intended to show the importance using a Public Key Infrastructure (PKI). PKI is a broad subject matter and is constantly evolving to meet the growing demands of the business world. This paper will address PKI at a relatively high-level and will not include details regarding the underlying cryptography (Weise, 2001). This paper will cover the history behind PKI, why we should us PKI, its purposes and functions how PKI works.

Introduction

With today’s security threat of hackers, spammers and viruses infecting computers, PKI is an essential component of an overall security strategy that must work in concert with other security mechanisms, business practices, and risk management efforts to help protect vital information (Weise, 2001). The Internet isn’t the only area of security that needs PKI, e-mail systems need to incorporate a higher level of security through digital signatures and e-mail encryption within the work environment to ensure business information is exchanged between validated and trusted recipients.

History

Public Key Infrastructure (PKI) is simply the single most effective method for securing a public communications networks, and is used throughout the world for the transmission of sensitive data. Government agencies, the U.S. Army, Navy, Air force, financial and medical institutions use PKI to ensure their communications are protected and safe from unwanted hackers and accidental transmission of sensitive communications to others.

The notion and concept of PKI dates back to the original paper on public key cryptography (Whitfield Diffie and Martin Hellman, 1976). What you might know about Diffie and Hellman is that they invented the concept of asymmetric ciphers, ones where there are two related keys, as opposed to symmetric ciphers, where there is only one key used. In their proposal, they suggested using two values that were related via some very slow to compute mathematical function, but where one value could be used to encrypt a message and the other to decrypt the enciphered message. Because the relationship between the two values would be non-trivial to compute, one of the key pair could be made public with no loss in the security of other, private, and key (Farrow, n.d.).

With the invention of PKI by Diffie and Hellman, they inevitably changed secure communications entirely and how we use it today. With the further development of high speed digital electronic communications the Internet and its predecessors, a need became evident for ways in which users could securely communicate with each other, and as a further consequence of that, for ways in which users could be sure with whom they were actually interacting. The idea of cryptographically protected certificates binding user identities to public keys was eagerly developed (Wikipedia, n.d.).

Vendors and entrepreneurs saw the possibility of a large market, started companies (or new projects at existing companies), and began to agitate for legal recognition and protection from liability. An American Bar Association technology project published an extensive analysis of some of the foreseeable legal aspects of PKI operations (see ABA digital signature guidelines), and shortly thereafter, several US states (Utah being the first

in 1995) and other jurisdictions throughout the world, began to enact laws and adopt regulations. Consumer groups and others raised questions of privacy, access, and liability considerations which were more taken into consideration in some jurisdictions than in others (Wikipedia, n.d.).

The enacted laws and regulations differed, there were technical and operational problems in converting PKI schemes into successful commercial operation, and progress has been far slower than pioneers had imagined it would be (Wikipedia, n.d.).

By the first few years of the 21st century, it had become clear that the underlying cryptographic engineering was not easy to deploy correctly, that operating procedures (manual or automatic) were not easy to correctly design (nor even if so designed, to execute ”perfectly”, which the engineering required), and that such standardization standards as existed were in some respects inadequate to the purposes to which they were being put (Wikipedia, n.d.).

PKI vendors have found a market, but it is not quite the market envisioned in the mid-90s, and it has grown both more slowly and in somewhat different ways than were anticipated. PKIs have not solved some of the problems they were expected to, and several major vendors have gone out of business or been acquired by others. PKI has had the most success in government implementations; the largest PKI implementation to date is the Defense Information Systems Agency (DISA) PKI infrastructure for the Common Access Cards program (Wikipedia, n.d.).

Why We Should Use PKI

Securing the infrastructure and data of an organization is not a simple task. There are many factors that must be considered before implementing security, such as the level of security we want to achieve. Based on the nature of the organization (i.e. e-commerce, healthcare, financial, and military), we need to apply appropriate security technologies to reach the required security level. If the organization needs a high level of security that calls for encryption, non-repudiation, authentication of users, and integrity of data, a Public Key Infrastructure (PKI) is a good starting point for addressing the problem.

With the growth in use of the Internet for business transactions, the need for confidentiality and positive identification of all parties involved is increasingly vital. The use of encryption and digital signatures are important tools in the ongoing struggle to maintain privacy and confidentiality over the Internet. Confidentiality of data stored on the corporate network is also becoming increasingly important for many organizations.

Public key infrastructure (PKI) is the perfect solution for ensuring the privacy of data employed in most corporate systems. This is especially true in the kinds of systems implemented as part of e-commerce solutions, where organizations are engaging in transactions with individuals who are unknown to them, and with whom they may never have any further contact.

Purpose, Function and How PKI Works

Public key systems allow us to communicate securely between individual and organization using keys which can be freely distributed and published anywhere; an example is like your telephone number in a directory. This can be achieved by the use of digital certificates, which bind a public key to an individual or organization and carry the signature of a trusted Certification Authority (CA) verifying its authenticity. A PKI
infrastructure does not serve a particular business function; rather, a PKI provides a foundation for other security services. The primary function of a PKI is to allow the distribution and use of public keys and certificates with security and integrity (Weise, 2001).

A PKI is a foundation on which other applications and network security components are built. Systems that often require PIK-based security mechanisms include:

• E-mail
• E-commerce (e.g., debit and credit cards)
• Government contractors sending sensitive information via e-mail Home Banking

PKI is not by itself an authentication, authorization, auditing, privacy, or integrity mechanism; PKI only allows for the identification of entities. For example: A PKI does not infer trust by itself, but requires the establishment of a trust base, on which the PKI can rely. This means that the basis of trust must be established on a personal, business, or other level, before it can be accepted by the PKI (Weise, 2001). There are a number of requirements that businesses have with respect to implementing effective public-key infrastructures. First and foremost, if users cannot take advantage of encryption and digital signatures in applications, a PKI is not valuable. Consequently, the most important constraint on a PKI is transparency. The term transparency means that users do not have to understand how the PKI manages keys and certificates to take advantage of encryption and digital signature services. An effective PKI is transparent (Entrust, 2006). In addition to user transparency, a business must implement the following items in a PKI to provide the required key and certificate management services: public key certificates

• a certificate repository
• certificate revocation
• key backup and recovery
• support for non-repudiation of digital signatures
• automatic update of key pairs and certificates
• management of key histories
• support for cross-certification
• client-side software interacting with all of the above in a secure, consistent, and trustworthy manner

Certificates and Certification Authorities

For PKI to be valuable and work properly, users must be assured that the other parties with whom they communicate are trustworthy. To provide this assurance, all users of a PKI must have a registered identity. In order to accomplish this; a trusted third party Certification Authorities (CAs) will provide various key management services. A CA essentially certifies the identity of an end entity (user). This is accomplished by an entity providing sufficient proof of their identity to the CA, and then having the CA generate a message containing the entity’s identity and public key (Weise, 2001). I recently went through this process of obtaining a digital signature certificate and e-mail encryption certificate for my current program. These identities are stored in a digital format known as a public key certificate. CAs create certificates for users by digitally signing a set of data that includes the following information (and additional items): The user’s name in the format of a distinguished name (DN). The DN specifies the user’s name and any additional attributes required to uniquely identify the user (for example, the DN could contain the user’s employee number). A public key of the user. The public key is required so that others can encrypt for the user or verify the user’s digital signature. The validity period (or lifetime) of the certificate (a start date and an end date). The specific operations for which the public key is to be used (whether for encrypting data, verifying digital signatures, or both).

The CAs signature on a certificate allows any tampering with the contents of the certificate to be easily detected. (The CAs signature on a certificate is like a tamper-detection seal on a bottle of pills?any tampering with the contents of a certificate is easily detected) As long as the CAs signature on a certificate can be verified, the certificate has integrity. Since the integrity of a certificate can be determined by verifying the CA?s signature, certificates are inherently secure and can be distributed in a completely public manner (for example, through publicly-accessible directory systems) (Entrust, 2006). Users retrieving a public key from a certificate can be assured that the public key is valid. That is, users can trust that the certificate and its associated public key belong to the entity specified by the distinguished name. Users also trust that the public key is still within its defined validity period. In addition, users are assured that the public key may be used safely in the manner for which it was certified by the CA (Entrust, 2006). How PKI Works:

In public key cryptography, a public and private key are created simultaneously using the same algorithm (a popular one is known as RSA) by a certificate authority (CA). The private key is given only to the requesting party and the public key is made publicly available (as part of a digital certificate) in a directory that all parties can access. The private key is never shared with anyone or sent across the Internet. You use the private key to decrypt text that has been encrypted with your public key by someone else (who can find out what your public key is from a public directory) (Searchsecurity.com, 2006).

An example of this; if I send you a message, I can find out your public key (but not your private key) from a central administrator and encrypt a message to you using your public key. When you receive it, you decrypt it with your private key. In addition to encrypting messages (which ensures privacy), you can authenticate yourself to me (so I know that it is really you who sent the message) by using your private key to encrypt a digital certificate (Searchsecurity.com, 2006). An example of this can be seen in figure 2 below.

1. Bob sends Stan an encrypted message.
2. Bob can get Stan’s public key (but not his private key) from the central administrator to encrypt the message.
3. Stan receives the encrypted message
   and decrypts using his private key.
4. In addition to sending encrypted messages (which ensures privacy), Stan can authenticate himself to Bob (so Bob knows that Stan is really Stan) by using his private key to encrypt a digital signature.

Conclusion

PKI is a very complex subject, more that I understand fully and is evolving in terms of its use in the commercial and e-commerce sectors. With the underlying technology pretty sound, the question of interoperability and performance still linger. With that said, PKI still offers great benefits to those in need of the basic security services of using a PKI implementation.

References

1. Farrow, Rik. Private Key Infrastructure; or, why there is no Public Key Infrastructure. Retrieved May 1, 2007 from: http://www.spinit.com/Network/net0903.html
2. Miller, Jason. GCN Staff (2006, November). PKI gets shot in the arm from HSPD-12. Government Computer News, page 7.
3. Entrust. (2006). Securing Digital Identities & Information. What is a PKI? Retrieved May 1, 2007 from: http://www.entrust.com/pki.htm?source=overture
4. Weise, Joel. Sun Microsystems (August 2001) Public Key Infrastructure Overview. Retrieved May 28, 2007 from: www.sun.com/blueprints
5. Unknown Author. Public Key Encryption and Public key Infrastructure – Explained. Retrieved May 1, 2007 from: https://www.safe-mail.net/support/eng/help/protectsecure/pki.html
6. Wikipedia, the free encyclopedia. (2007). Public Key Infrastructure. Retrieved May 1, 2007 from: http://en.wikipedia.org/wiki/Public_key_infrastructure
   Wikipedia, the free encyclopedia. (2007). Digital Signature. Retrieved May 1, 2007 from: http://en.wikipedia.org/wiki/Digital_signature
7. Unknown Author. Public Key Encryption and Public key Infrastructure – Explained. Retrieved May 1, 2007 from: https://www.safe-mail.net/support/eng/help/protectsecure/pki.html