Moving Toward an IPv 6 Future

Generally speaking, a public key infrastructure (PKI) is a set of hardware, software, people, and procedures needed to create, manage, store, distribute, and revoke public key certificates. With these in place, a PKI can provide trusted and efficient privateand publickey certificate management, thus enabling the use of authentication, nonrepudiation, and confidential security services. To provide such services, a PKI uses its base components, which include a certification authority, at least one registration authority, and a request server. Some PKIs use extra components, depending on the services their particular implementations offer. At the University of Murcia, Spain, we developed UMU-PKI, which uses opensource software and Java for its internal components (see https://pki.dif.um.es).1 UMU-PKI supports LDAP directories, Java cards, and RSA smartcards; it also has policy-based management2 and Webbased registration methods for end users. In addition to this, it implements three advanced security services: a time-stamp authority,3 an online certificate status protocol (OCSP) authority,4 and a simple certificate enrollment protocol (SCEP) server,5 which can accept certificate requests from secure gateways. The European IPv6 Internet Exchanges Backbone (Euro6IX, www.euro6ix.org) project is one of the major focuses within the EU’s 5th Framework Program and is devoted to the implementation of a European native IPv6 network. It provided us with the perfect opportunity to test UMUPKI to ensure that it could migrate current security services from IPv4 to IPv6 (see the sidebar). The project also gives us real IPv6 experience with end users, ISPs, and Internet exchanges (IXs). This article describes how UMU-PKI fared in testing and which new services we can build over this IPv6-enabled PKI.