1. An Analysis of XKMS
Yamini Ghadge Shanky Subramanian

2. Agenda Why XKMS? – Problems with PKI What XKMS? Before XKMS After XKMS
Advantages
XKRSS
XKISS
Conclusion

3. Why XKMS? – Problems with PKI
Burden is on the Client to perfom expensive operations
-- ASN.1 encoding /decoding
-- Signature verification
-- Chain Validation
-- Revocation Checking
Interfacing application to PKI service
-- Proprietary PKI vendor toolkits
-- need of complex functions
-- incompatibility with different PKI vendors

4. What is XKMS? XML Key Management Specification.
A Trust Service solves the client deployment problem by shielding the client from the complexity of the underling PKI.
Not bound to a particular PKI

5. Before XKMS

6. After XKMS

7. Advantages Ease of Management Less complex application
Application is free from ASN.1 0r X.509 processing
Very small client footprint.
Deployment of new PKI features does not require deployment of new clients.

8. Components of XKMS XML Key Registration Service Specification (XKRSS)
Mechanism for registering a key pair with the service provider
Client - generates a key pair and provides the public key, along with other information, to the service provider for registration.
XKMS service - generates a key pair for the client, registers the public key of the pair with itself, and sends the private key of the pair to the client for its use.
XKMS service keeps the private key as well in case the client loses its private key.

9. Components of XKMS XML Key Registration Service Specification (XKRSS)
XKRSS defines 4 operations
Register – public key with some information
Reissue – previously generated key binding reissued when new credentials are added to PKI
Revoke – allows clients to destroy data objects to which key is bound. Ex. X.509 certificate bound to the XKMS key destroyed when revoke is called.
Recover – client recovers the lost private key only if registered with the service provider

10. Components of XKMS XML Key Information Service Specification (XKISS)
Mechanism that allows client applications to authenticate encrypted/signed data.
This is done by passing the corresponding key information to service provider.
Service provider responds with “ true” or “false”
"True" indicates that the public key corresponding to the private key used for signing belongs to the claiming entity.

11. Components of XKMS XML Key Information Service Specification (XKISS)
XKISS defines 2 operations
Locate – Finds the key based on element in the key information that is associated with XML encryption or XML signature
Validate – It not only finds the key as locate does but also validates the key binding information associated with it.

12. Conclusion
XKMS is a web service that provides interface between XML application and PKI
It simplifies deployment of enterprise PKI by transferring complex processing tasks from client application to a trust service .