Issues with centralized PKIs

Two users in order to have a secure connection between each other have to have and exchange keys. In total, there are three basic approaches to exchanging public keys:

1. In a personal meeting — the direct transfer of a public key from one user to another, without the use of any public networks of data transferring (such as the internet).
2. A key, which has been used before — across a non-secure network, but with the protection of a previously used key.
3. With the aid of a trusted third party — obtaining the public key from a user through a trusted third party, through whom a secure line of communication has already been established.

Having reviewed the three basic approaches, you understand that the second and third options are basically more complex versions of the first one. This means that in order to start operating in an information system with public keys securely, it is necessary to hold at least one personal meeting between users so that they could exchange their key hand to hand. PKI, which stands for public key infrastructure, plays one of the most essential roles in the functioning of the entire Internet. It is aimed at solving the problem of secure exchange of public keys between users with the aid of a trusted third-party.

PKI is intended to ensure an authentic compliance between the identifier of a party and their public key. Checking such compliance is essential for ensuring the authenticity of the party with whom you manage to establish a secure connection. The most vital issue lies in the establishing of coherence between the identity (i.e. the identification data) and the user’s public key. That’s a challenge that’s been resolved using a Public Key Certificate — an electronic document that establishes proof of ownership of the key. The Certificate contains the public key and user’s identification information along with an electronic signature of the trusted party who has physically verified the user. That is to say, the certificate should be signed by the trusted party — Certificate Authority, in order to ensure its integrity and authenticity.

The Certificate Authority (CA) is an organization, which checks the authenticity of the identification information, and generates digital certificates to the next hierarchical level of Certification Authorities and to end-users. Certificate Authority is a specific trusted party in the interaction of end-users. It has its own certificate by the key of which it signs all other certificates that have been issued by it.

The Root Certificate Authority (Root CA) is the Certificate Authority, which doesn’t subordinate to any other centers (it’s at the peak of the hierarchy). A certificate from this center is signed with its own key and is called a self-signed certificate.

For any certificate issued to a user, it is possible to construct what is known as a certificate chain. User’s certificate refers to the certificate of the center, by which it was issued, while the certificate of the center refers to another certificate of the center that’s above the hierarchy, and so on. This means that you can build a chain of certificates that leads all the way to the certificate of the Root CA, thereby verify all the electronic signatures in this chain. This procedure is mandatory when verifying a certificate before having to use it.

The life-cycle of a certificate consists of the following stages:

1. A request is sent to the Certificate Authority to issue a public key certificate and verify the user’s identity.
2. A certificate is issued in accordance with the data detailed in the request, and the prevailing certification policy.
3. The certificate is distributed among the members of the information system.
4. Storage and issuance of the certificate at the request of users and certificate owners.
5. The certificate may be suspended or renewed.
6. Information in the certificate may be updated along with the pair of keys.
7. The certificate may be revoked at the request of its owner, or the regulatory body.
8. A certificate may expire, or be reissued if necessary.

The existing PKI currently operates only under the condition that users’ browsers are able to correctly verify

1. the chain of certificates;
2. their status;
3. that cryptographic computations have been implemented properly and operate correctly;
4. that confidential key data is not compromised;
5. that the set of root certificates on the client side is correct.

So, the Centralized PKI of mass use, particularly when deployed for web resources, have a whole raft of complexities and issues, including:

1. The problem of rapid notification of the compromised keys. The setting-up and distribution of a list of revoked certificates can take from several minutes to up to an hour. As a result, there you can never 100% guarantee that a particular key belongs to an identified user at a particular moment in time.
2. If certificate checking is carried out online (request to the Certificate Authority), then user’s privacy is violated because the Certificate Authority will see the entire history of user interactions.
3. Difficulties in unveiling the presence of certificates from undesirable Root Certificate Authorities. In such cases, a special equipment can be installed, on the route between the client and the server, which decrypts all data seamlessly for the client and the server.
4. A number of certificates could be issued in an identical name. In other words, the same identifier could be certified at different Root CAs.
5. The process of updating certificates is complex since requires a repeated access to the registration center, changing the data, reissuing the certificate, and then verifying it once again with the Certificate Authority.
6. The complexity related to the existence of different standards for electronic signatures, which results in the compatibility problem between users.
7. A system center is basically a system’s single point of failure, which can lead to a large number of threats such as compromisation of Root Certificates.
8. The centralized PKI implies that identifiers are in the hands of a centralized organization and do not belong to the actual owners.

Post in Russian