PKI

Public Key Infrastructure (PKI)

  • PKI is a framework that manages digital certificates and public-private key pairs to enable secure communications and authentication across networks
  • Think of it as the digital equivalent of a government ID system - it establishes trust between parties who have never met
  • Uses asymmetric cryptography where each entity has a mathematically related key pair: one public (shared openly) and one private (kept secret)

Core PKI Components

  • Certificate Authority (CA): The trusted third party that issues, validates, and revokes digital certificates (like a government DMV issuing driver’s licenses)
  • Registration Authority (RA): Verifies the identity of certificate requestors before forwarding to CA (like the clerk who checks your documents)
  • Certificate Repository: Database storing issued certificates and Certificate Revocation Lists (CRLs)
  • Digital Certificates: Electronic documents that bind a public key to an identity using the CA’s digital signature

PKI Process Flow

  • Entity generates public-private key pair locally
  • Entity submits Certificate Signing Request (CSR) with public key and identity information to RA
  • RA verifies identity and forwards approved request to CA
  • CA creates digital certificate by digitally signing the requestor’s public key and identity
  • Certificate is published to repository for public access
  • Other entities can now verify the certificate’s authenticity using the CA’s public key

Certificate Types and Standards

Certificate Type Use Case Validity Period Key Details
Root CA Self-signed, top of trust chain 10-20 years Never used directly for end-entity certificates
Intermediate CA Signed by Root CA, issues end certificates 3-10 years Allows Root CA to remain offline for security
End-Entity/Leaf User, device, or service certificates 1-3 years Cannot sign other certificates
Wildcard Secures multiple subdomains 1-2 years Uses *.domain.com format

X.509 Certificate Structure

  • Version: X.509 version (typically v3 for modern certificates)
  • Serial Number: Unique identifier within the CA’s domain
  • Subject: Distinguished Name (DN) identifying the certificate holder
  • Issuer: DN of the CA that signed the certificate
  • Validity Period: Not Before and Not After dates
  • Public Key Info: Algorithm and the actual public key
  • Extensions: Additional fields like Subject Alternative Names (SANs), Key Usage, Extended Key Usage

Trust Models and Hierarchies

Hierarchical Trust Model

  • Most common in enterprise environments
  • Single Root CA at top, with subordinate CAs forming a tree structure
  • Trust flows downward from root to intermediate to end-entity certificates
  • Advantage: Centralized control and clear trust paths
  • Disadvantage: Single point of failure if root is compromised

Cross-Certification Model

  • Multiple CA hierarchies that cross-certify each other
  • Used when organizations need to establish trust between separate PKI domains
  • Common in government and military applications where different agencies maintain separate PKIs

Web of Trust Model

  • Decentralized model where users sign each other’s certificates (used in PGP/GPG)
  • Not typically used in enterprise networks due to scalability and management challenges

Certificate Validation Process

  • Path Validation: Verifying the certificate chain from end-entity up to a trusted root
  • Revocation Checking: Ensuring certificate hasn’t been revoked via CRL or OCSP (Online Certificate Status Protocol)
  • Time Validation: Confirming current time falls within certificate’s validity period
  • Purpose Validation: Verifying certificate’s intended use matches actual use (Key Usage and Extended Key Usage extensions)

Certificate Revocation Methods

Method Description Pros Cons
CRL Periodic list of revoked certificates Simple, widely supported Large files, infrequent updates
OCSP Real-time revocation checking Current status, smaller queries Requires network connectivity, privacy concerns
OCSP Stapling Server provides OCSP response with certificate Reduces client queries, better performance Server must maintain fresh responses

PKI in Network Security Applications

SSL/TLS Certificates

  • Secure web communications (HTTPS on port 443)
  • Server authentication prevents man-in-the-middle attacks
  • Client certificates enable mutual authentication (common in enterprise environments)
  • Certificate pinning helps prevent certificate authority compromise attacks

IPSec VPN Authentication

  • Digital certificates authenticate VPN peers instead of pre-shared keys
  • Provides non-repudiation and scales better than PSKs in large deployments
  • Common in site-to-site VPNs between organizations

802.1X Network Access Control

  • EAP-TLS uses client certificates for strong authentication
  • Eliminates password-based attacks on wireless and wired networks
  • Machine certificates enable device authentication before user login

Code Signing

  • Ensures software integrity and authenticity
  • Operating systems verify signatures before executing code
  • Critical for firmware updates on network devices

Notes

  • Root CA private keys should be kept offline and in hardware security modules (HSMs) - compromise of root key invalidates entire PKI
  • Certificate lifetimes are security vs. operational trade-offs: shorter lifetimes reduce exposure window but increase management overhead
  • Always implement certificate lifecycle management including automated renewal before expiration
  • OCSP responder availability is critical - configure fallback mechanisms or soft-fail policies to prevent service disruptions
  • For high-security environments, consider implementing Certificate Transparency logs to detect unauthorized certificate issuance
  • Private key protection is paramount - use HSMs or at minimum encrypted storage with strong access controls
  • Plan for CA key rollover and certificate migration procedures before certificates approach expiration
  • Monitor certificate transparency logs and implement certificate pinning for critical applications to detect rogue certificates
  • Consider the impact of quantum computing on current cryptographic algorithms - NIST is standardizing post-quantum cryptography standards