Public Key Infrastructure
David Croughwell
Prof. George Danilovics
Networking Security Fundamentals (CIS333)
17 February 2013

Public Key Infrastructure

In discussing the Public Key Infrastructure (PKI) we need to discuss the differences between asymmetric and symmetric keys. These two keys differ in how they are distributed to the various parties that would like to transfer information. Symmetric can be completed by hand delivery, transmitting the key encrypted with a public key, or through a secure connection. This symmetric key or “private key” is used by both parties for encryption and decryption, this method once the key is obtained is the faster of the two and the most secure. Private keys can also be incorporated with hardware devices which will also increase the speed in which the encryption/decryption takes place. Asymmetric keys or “public keys” are a combination of private keys and public keys, since in circumstances the individual receiving the file would have no other ways of receiving the private key securely. This requires a key that is generated so that it can be linked with the private key, being linked like this allows you to post the public key to certificate authorities who will verify that the two keys come from the individual that you expected. The means of identifying who you are can be handled by a third-party corporation. This is completed by utilizing a digital signature which is the equivalent of a handwritten signature. This tells the recipient that the document was created or authorized by the creator. These third parties who are known as certificate authorities (CA) would contact the registration authority (RA). The registration authority is the organization that validates the user requesting a digital certificate and grants permission to the certificate authority for issuing the certificate. A digital certificate is a binding document in which a public key actually belongs to the identity associated with that key. Once the key is authenticated you can use it to encrypt data being sent to the recipient who holds the other half of this public key. The certificate authority is the trusted third-party by both parties involved that will create the certificate. Although these are used for large organizations and the public, smaller businesses may not actually use these for internally created digital certificates. This can be completed through a local certificate authority server maintained by the private organization this would allow members of that organization to encrypt mail and data that could use asymmetric encryption. Although the RA and CA are two of the most critical parts of the PKI, they are not the only ones. Other pieces of the PKI include the subscriber or the person requesting the certificate. As a person or organization requests these certificates they will need a means of organizing them and storing them this is handled by the certificate repository. The repository must be able to monitor the certificates and track whether or not they are still valid. Certificates have expiration dates and as such must be pulled from the current active certificates and placed in the certificate revocation list or the CRL. The CRL does not only hold expired certificates but also certificates that have been revoked for other reasons. Certainly when making a decision between a public CA and an in-house CA you would have to consider the cost in each. The costs though have to include not just initial costs but also to maintain the system. This would include possibly more staff members or more experienced staff members. It could also include increased physical security as well as increased network security. Is the company capable of handling users registering for certificates? When looking at these items it makes deciding whether or not to run an in-house certificate authority. Advantages of running an internal certificate authority are there and include greater control over the certificates. If there is concern for interoperability within the organization this could be eliminated by running the certificate authority in-house. This also reduces the close management of the CRLs, which could reduce the work load for employees. A recommended solution as to which CA is better to use will be dependent on the size of the company, but the easiest solution is to use an in-house CA. The operation of the CA is critical to many businesses today. Many of the businesses today have an e-commerce site which would be dependent on these certificates being available and fully operational. Many of these issues would be better protected if they are handled by the company that needs them. Handling this issue personally by the company will help to ensure that their online appearance is maintained at a high standard. It also reduces the possibilities of breaching the company’s certificate practices. It also is an asset having an individual on the staff that is an expert or extremely knowledgeable on PKI issues and will be available to aid in business decisions.

Bibliography
Adams, C., & Lloyd, S. (2002). Understanding PKI: Concepts, Standards, and Deployment Considerations. Boston: Addison-Wesley Professional.
PC Magazine. (2013, February 17). Encyclopedia: PC Magazine website. Retrieved from PC Magazine Web Site: http://www.pcmag.com/encyclopedia_term/0,2542,t=cryptography&i=40522,00.asp
RSA Data Security. (1999). Understanding Public Key Infrastructure. RSA Data Security.
Walder, B. (2003, July). In-house or out: how to start building a PKI. Retrieved from Computer Weekly Web Site: http://www.computerweekly.com/feature/In-house-or-out-how-to-start-building-a-PKI