Growing a Tree Of Trust -- Part One

What are Public Key Infrastructures?

Using applied cryptography, PKIs govern the distribution and management of cryptographic keys and digital certificates that allow you to take advantage of several fundamental features:

Confidentiality of information assures users that their communications are safe and readable only by the intended recipients. Message encryption using digital certificates assures this confidentiality.

Integrity of data guarantees that message contents are not altered during the transmission between the originator and the recipient. PKIs provide for digital signatures to ensure the integrity of all transmitted information

User authentication enables systems and applications to verify that users are who they claim they are and have the authority to access the resource. PKIs use digital signatures and user certificates to assure the authentication of all end entities and system resources.

Non-repudiation prevents users of the PKI to deny that they''ve participated in a transaction or sent a message to another user or resource. With a legitimate digital signature in hand and the legitimate digital certificate that accompanies it, the chances that a message is forged or originated elsewhere approaches zero.

System interoperability -- due to strict standards compliance -- enables a PKI''s operation across a variety of hardware and software systems without concern for incompatibilities.

Effective PKIs are based on the Public Key Cryptographic Standards (PKCS), a family of standards which include:

RSA encryption for the construction of digital signatures and digital envelopes.

Diffie-Hellman key agreements that define how two people, with no prior arrangements, can agree on a shared secret key that''s known only between them and used for future encrypted communications.

Password based encryption hides private keys when transferring them between computer systems, sometimes required under Public-Private Key Cryptography.

Extended certificate syntax permits the addition of extensions to standard X.509 digital certificates. These extensions add information such as certificate usage policies, other identifying information, etc.

Cryptographic message syntax describes how to apply cryptography to related data, including digital signatures and digital envelopes.

Private-key information syntax describes how to include a private key along with algorithm information and a set of attributes to offer a simple way of establishing trust in information provided.

Certification request syntax describes the rules and sets of attributes needed for a certificate request from a certificate authority.

Recall that a digital certificate binds a previously-authenticated private key holder (a person) to the public key that accompanies it. This attestation, performed by a trusted party creates a message containing the person''s identification information, their public key, certificate usage rules, and other information. This message is then signed using the CA''s private key, and returned to the private-key holder. Additional information about digital certificates can be found in Electronic Keys For A Digital Tomorrow". PKI hierarchies of trust use this concept to manage the public keys for all users, internal and external. With a PKI in place, a "Tree of Trust" is formed to represent how Certificate Authorities control certain aspects of other Certificate Authorities in the branches below them. Constructing this tree is one of the first activities in developing a PKI and are embodied in the Certificate Practices Statement (CPS) discussed later.