PKI

Public key infrastructure (PKI) is a framework for managing digital certificates and public-key cryptography to enable secure communications and authentication over untrusted networks. It provides a means to verify that a public key belongs to the claimed identity and to establish a trusted connection between parties.

A PKI binds a public key to the identity of an entity through certificates issued by trusted authorities. The core components include certification authorities (CAs), registration authorities (RAs), certificate repositories, and mechanisms for certificate status information such as certificate revocation lists (CRLs) or Online Certificate Status Protocol (OCSP) responders. Private keys are typically generated and controlled by the entity, while public keys are distributed via certificates.

The certificates themselves are typically X.509 documents, and the system relies on a chain of trust anchored in one or more trusted roots. The trust model requires that each certificate issued by a CA can be validated up to a trusted root. Private keys must be kept secure, and private-key protection is central to PKI security.

Key management processes cover enrollment, certificate issuance, renewal, revocation, and expiration. Validation uses certificate authorities, chain-building, and status checking via CRLs or OCSP to determine whether a certificate is currently trusted.

PKI enables secure transport with TLS/SSL, email security with S/MIME, code signing, and document signing. Common models include hierarchical PKIs with root and subordinate CAs, cross-certification, or other trust arrangements.

Security considerations emphasize protecting private keys, strong identity verification during enrollment, regular revocation of compromised certificates, auditing, and protection of the root authority. Compliance with standards (e.g., X.509, PKCS) and interoperability between vendors are important for effective PKI deployment.