Stepping Beyond the PKI Pilot

Despite much of the negative publicity that it has suffered recently, Public Key Infrastructure (PKI) continues to play a critical role in underpinning security on the Internet and other potentially hostile network environments. In such environments, it is common to deploy secure protocols to deliver one or more standard network security services (authentication, confidentiality protection, integrity protection and sometimes non-repudiation) so that individuals and/or organisations can communicate securely. Whilst all this can be achieved without using PKI, setting up and maintaining the trust relationships that support these protocols turns out to be a major challenge when there are many parties involved. This is the challenge that PKI solves – it provides a framework, which allows a Trusted Third Party (TTP) to extend trust to other individuals or organisations (known as subscribers in this context), thereby providing them with a context to support some kind of exchange or transaction. In addition to providing a trust framework, PKI is also a useful way of standardising the implementation of the security services as it is based on the use of (usually X.509) certificates and standard, public key algorithms.