1. An In-Depth Examination of PKI Strengths, Weaknesses and Recommendations

2. Encryption Hiding the intent or meaning of a message Hiding the intent or meaning of a message Complex mathematical algorithms Complex mathematical algorithms Should be unbreakable Should be unbreakable Claude Shannon, the Father of Information Theory Claude Shannon, the Father of Information Theory

3. Shared and Public Key Shared Key Encryption Shared Key Encryption Same Key for Encryption/Decryption Same Key for Encryption/Decryption Key dispatched in secure manner Key dispatched in secure manner DES, 3DES, AES DES, 3DES, AES Public Key Public Key Key Generation Key Generation Encrypt with Public Key Encrypt with Public Key Decrypt with Private Key Decrypt with Private Key RSA RSA

4. Digital Signatures and Certificates Digital Signature Digital Signature Create Message Digest (MD5, SHA1) Create Message Digest (MD5, SHA1) Sign Hash Sign Hash Append Signed Hash to Message Append Signed Hash to Message Verify by hashing message, public key decrypt of message Verify by hashing message, public key decrypt of message Digital Certificate Digital Certificate Public Key, Authority Signature, Key Information Public Key, Authority Signature, Key Information Mutually trusted authority signature Mutually trusted authority signature

5. What is PKI? Infrastructure Infrastructure End Entity End Entity Certificate Authority Certificate Authority Registration Authority Registration Authority Directory (X.500, LDAP) Directory (X.500, LDAP) CRL Repository CRL Repository PKI not itself a solution – SSL/TLS PKI not itself a solution – SSL/TLS

6. Issues with PKI Key Management Key Management CRL Distribution CRL Distribution Trust Trust

7. Key Management Where? Where? On laptops, desktops? On laptops, desktops? Centrally located (protected)? Centrally located (protected)? Multiple certificates? Multiple certificates? Backing up Keys – why? Backing up Keys – why? Smartcards Smartcards Tamper-resistant Tamper-resistant Work with magnetic-stripe cards Work with magnetic-stripe cards Portable, holds multiple keys Portable, holds multiple keys

8. Certificate Revocation Lists Performance Performance DoS DoS Frequent Information Frequent Information Solutions Solutions Segmenting Segmenting Over distribution Over distribution Online Certificate Status Protocol (OCSP) Online Certificate Status Protocol (OCSP) Validity real-time Validity real-time Expensive Expensive

9. Trust How/Why do we Trust CAs? (CSPs) How/Why do we Trust CAs? (CSPs) Do we read/view certificates? Do we read/view certificates? Authentication not authorization Authentication not authorization Usability and Trust Usability and Trust “Web of Trust” “Web of Trust”

10. Conclusion All-encompassing solution All-encompassing solution Many aspects are implementation-specific Many aspects are implementation-specific Key to evaluate needs of the applications Key to evaluate needs of the applications