PKI Scalability Issues

We spend much of our time trying to communicate with each other. Wide-spread use of the Internet has increased the number of ways and the amount we communicate with each other. For example, we may now spend many hours per day simply writing and replying to e-mails. Like normal communication, there is information that can be publicly known (or at least we do not care if someone else knows it), and there are critical messages that we prefer only to be in the possession of the intended recipient(s). Going into a dark alley to send an e-mail does not mean that it was delivered to the right person and that the information remains confidential. Encryption helps solve problems of confidentiality. Private key or symmetric encryption systems transform, by applying complex mathematical functions, our secret message written in plain language to something that will look like gibberish. In order to reverse the transformation you need to know the correct key. Any two users trying to communicate securely can agree on a shared secret key and use symmetric encryption systems to protect their information. If the same user wants to talk with a third user, they need to agree on another key. In the end, symmetric encryption systems that wish to support communication between members of arbitrary subgroups need Θ(n) private keys, where n is the number of users (one key for each pair of users). This is quite impractical. Public key or asymmetric cryptography allows individuals to define two keys: a public one for encryption, and a private one for decryption. Now, instead of agreeing on one private key, Alice can encrypt a message for Bob using his public key and send it. Bob, knowing the corresponding private key will decrypt the message and read it. Eve, a malicious user listening to Alice and Bob’s communications, will not be able decrypt the messages because she does not know the private keys. The total number of secret keys per user is reduced from n−1 to just 1. A problem with asymmetric encryption is that it is significantly slower than symmetric encryption systems. We can solve this problem using asymmetric systems to agree on a per-session symmetric key to be used for the bulk of the encryption workload. Still, a major problem remains. How can be Alice sure that the key is actually Bob’s public key and not Eve’s public key? Public Key Infrastructures (PKIs) help solve this problem. The purpose of a PKI is two-fold: (1) to help Alice retrieve Bob’s public key and (2) to give Alice confidence that the key really belongs to Bob. There are several PKI implementations. The lack of standards and the need to have a solution that can be easily used, even for large environments, have delayed the global adoption of a PKI. We have been studying the scalability of PKIs, and in this report we present several current PKI implementations and discuss the most important issues related to them. In section 2 we present an overview discussion of different PKIs. Section 3 describes different problems with traditional PKIs during enrollment and certificate issuance along with three different PKI solutions to those problems. Section 4 discusses several certificate revocation systems and discusses scalability issues with each. People are now trying to enhance PKI by providing real-time services; section 5 reviews some of those services. Then, in section 6 we discuss PKI issues that are