PUBLIC KEY
INFRASTRUCTURE
PUBLIC KEY INFRASTRUCTURE
(PKI)
➢ Public key infrastructure (PKI)
▪ Public-key infrastructure (PKI) is the set of hardware, software, people,
policies, and procedures needed to create, manage, store, distribute, and
revoke digital certificates based on asymmetric cryptography.
➢ Purpose of PKI
▪ The purpose of developing a PKI is to enable secure, convenient and
efficient obtain public keys.
➢ PKIX
▪ Public key infrastructure X.509 is called as PKIX.
PKIX
Architect
ure
Model
➢ The interrelationship among the key elements of the PKIX model.
▪ These Elements are,
✓End entity
✓Certification authority (CA)
✓Registration authority (RA)
✓CRL issuer
✓Repository
➢ End entity
A generic term used to denote end users, devices (eg., servers, routers), or any
other entity that can be identified in the subject field of a public key certificate.
➢ Certification authority (CA)
The issuer of certificates and certificate revocation list (CRLs). It may also support a
variety of administrative functions, although these are often delegated to one or
more registration authorities.
➢ Registration authority (RA)
An optional component that can assume a number of administrative functions from
the CA. The RA is often associated with the End Entity registration process, but
can assist in a number of other areas as well.
➢ CRL issuer
An optional component that a CA can delegate to publish CRLs.
➢ Repository
A generic term used to denote any method for storing certificates and CRLs so that
they can be retrieved by End Entities.
PKIX MANAGEMENT
FUNCTIONS AND
PROTOCOLS
PKIX Management Functions:
PKIX identifies a number of management functions that potentially need to be
supported by management protocols
These are indicated in figure and included following
1. Registration:
This is the process whereby a user first makes itself known to a CA
(directly, or through an RA), prior to that CA issuing a certificate or certificates for
that user. Registration begins the process of enrolling in a PKI. Registration usually
involves some offline or online procedure for mutual authentication. Typically, the
end entity is issued one or more shared secret keys used for subsequent
authentication.
2. Initialization:
Before a client system can operate securely, it is necessary to install key
materials that have the appropriate relationship with keys stored elsewhere in the
infrastructure.
3. Certification:
This is the process in which a CA issues a certificate for a user's public key,
and returns that certificate to the user's client system and/or posts that
certificate in a repository.
4. Key pair recovery:
Key pairs can be used to support digital signature creation and verification,
encryption and decryption, or both. Key pair recovery allows end entities to
restore their encryption/decryption key pair from an authorized key backup
facility (typically, the CA that issued the End Entity's certificate).
5. Key pair update: :
All key pairs need to be updated regularly (i.e., replaced with a new key pair)
and new certificates issued. Update is required when the certificate lifetime
expires and as a result of certificate revocation
6. Revocation request:
An authorized person advises a CA of an abnormal situation requiring
certificate revocation. Reasons for revocation include private key
compromise, change in affiliation, and name change
7. Cross certification:
Two CAs exchange information used in establishing a cross-certificate
PKIX Management Protocols
The PKIX working group has defines two alternative management protocols
between PKIX entities that support the management functions listed in the preceding
subsection.
RFC 2510 defines the certificate management protocols (CMP).
Within CMP, each of the management functions is explicitly identified by specific
protocol exchanges.
CMP is designed to be a flexible protocol able to accommodate a variety of
technical, operational, and business models.
RFC 2797 defines certificate management messages over CMS (CMC), where
CMS refers to RFC 2630, cryptographic message syntax.
CMC is built on earlier work and is intended to leverage existing implementations.
Although all of the PKIX functions are supported, the functions do not all map into
specific protocol exchanges.
