Table of Links Abstract and I Introduction Abstract and I Introduction II. PKI Problems and Risks II. PKI Problems and Risks III. Evolution of PKI III. Evolution of PKI IV. National Digital Identity Implementations IV. National Digital Identity Implementations V. Conclusion and References V. Conclusion and References II. PKI PROBLEMS AND RISKS The fundamental component of Public Key Infrastructures, involving key exchange through the RSA cryptosystem, has faced various attacks since its inception. Achieving secure implementation of RSA is a challenging endeavor, underscoring the complexity associated with deploying public key cryptography. [14] In recent years, PKIs have gained attention, with many organizations announcing their intention to provide certification services to the public. While some have successfully implemented PKIs, challenges leading to failures can be attributed to a variety of factors, including technical, economic, legal, and social considerations. [38]. • Technical Reasons: The technical landscape of PKIs is beset with complexities. Central to PKIs are public key (X.509) certificates, intricate and non-intuitive data structures. Their complexity poses substantial obstacles to deploying PKIs on a large scale, which is at odds with the direction of creating national or global digital identities. Furthermore, managing certificates, including tasks like key pair generation and certificate revocation, proves to be a daunting and error-prone undertaking. PKIs rely on globally unique X.500 Distinguished Names (DNs), which are often challenging to define and maintain resulting in death-by-complexity of its usage. Alternative models like SPKI and SDSI have struggled to gain widespread adoption. Additionally, cross-certification, the mutual recognition of Certificate Authorities (CAs), faces challenges due to variations in certification practices and a lack of incentives for cross-certification. • Technical Reasons: • Economical Reasons: Establishing and operating a PKI necessitates substantial investments in secure facilities, hardware, and personnel. Calculating the Return on Investment (ROI) for PKIs is intricate since they provide infrastructure rather than specific chargeable services. This intricacy makes building a sustainable business case for Certification Service Providers (CSPs) offering certificates a formidable task, given the high costs and limited revenue streams. • Economical Reasons • Legal Reasons: PKIs raise questions about liability, with certificate providers potentially held accountable for damages resulting from misuse or technical failures. As further elaborated in the subsequent discussion of risks, the inability to repudiate digitally signed statements can lead to predicaments for certificate owners who may be unjustly held responsible for actions they did not authorize. • Legal Reasons: • Social Reasons: Certificates are sometimes misunderstood as a means to establish trust, but trust in digital relationships differs from real-world trust based on personal experiences with the level of trust we get from certificates often being overestimated. In addition, users often lack awareness of the vulnerabilities and risks associated with public key cryptography, accepting certificates without considering potential security implications. • Social Reasons: As highlighted by Carl Ellison and Bruce Schneier in various risks associated with Public Key Infrastructure and the use of digital certificates, PKI is not a silver bullet for security and has potential pitfalls and challenges in its implementation [21]. These risks are presented as: • Trust in Certificates • Trust in Certificates The risk of misplaced trust in certificates issued by Certificate Authorities (CAs). Just because a CA is ”trusted” doesn’t mean you can necessarily trust a certificate for a specific purpose. • Identity Verification Challenges in verifying the true identity of the certificate holder, particularly when relying on names or other identifiers. • Identity Verification • Non-Repudiation • Non-Repudiation Legal issues surrounding non-repudiation, where individuals may be held legally responsible for actions taken with their private keys, even if those actions were not their own. • Security of Verifying Computers • Security of Verifying Computers The need to ensure the security of computers used to verify certificates, as compromising these computers can lead to security risks. • Certificate Authority Authority • Certificate Authority Authority Questions about the authority of CAs to grant specific authorizations in the certificates they issue. • User Involvement • User Involvement The importance of considering users’ understanding and actions when using certificates. • Registration Authorities • Registration Authorities Risks associated with the use of Registration Authorities (RA) in addition to CAs in the certificate issuance process. • Certificate Holder Identification • Certificate Holder Identification Challenges in identifying the certificate holder, especially when relying on external sources like credit bureaus. • Certificate Practices The importance of well-designed certificate practices and standards to ensure the proper use of certificates. • Certificate Practices • Single Sign-On • Single Sign-On The need to consider how PKI integrates with other security practices, such as Single Sign-On (SSO), and the limitations of SSO in maintaining security. Authors:
(1) Adrian-Tudor Dumitrescu, Delft University of Technology, Delft, The Netherlands (A.T.Dumitrescu@student.tudelft.nl);
(2) Johan Pouwelse (thesis supervisor), Delft University of Technology, Delft, The Netherlands (J.A.Pouwelse@tudelft.nl). Authors: Authors: (1) Adrian-Tudor Dumitrescu, Delft University of Technology, Delft, The Netherlands (A.T.Dumitrescu@student.tudelft.nl); (2) Johan Pouwelse (thesis supervisor), Delft University of Technology, Delft, The Netherlands (J.A.Pouwelse@tudelft.nl). This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv

Part of HackerNoon's growing list of open-source research papers, promoting free access to academic material.

Public

Why Public Key Infrastructure Isn’t the Silver Bullet for Digital Security

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

15 Common Types of Unethical Behavior Found in Open-Source Projects

53 Years of Public Key Infrastructure and It's Still Broken?

A Timeline of Public Key Infrastructure: What Worked, What Failed, and What’s Next

Would You Trust Your Government With Your Digital Identity?

Why Netflix Joined the Certificate Wars (And Why It Matters)

102 Stories To Learn About Encryption

15 Common Types of Unethical Behavior Found in Open-Source Projects

53 Years of Public Key Infrastructure and It's Still Broken?

A Timeline of Public Key Infrastructure: What Worked, What Failed, and What’s Next

Would You Trust Your Government With Your Digital Identity?

Why Netflix Joined the Certificate Wars (And Why It Matters)

102 Stories To Learn About Encryption

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps