Can Public Key Infrastructure Provide More Security Online?

Takeaway: PKI’s complexity and initial cost has discouraged several organizations from taking it on, but many other large organizations are making the transition.

Everything’s connected. iPads, iPods, iPhones and even landline phones are all connected to this relatively new frontier we call the Internet. The accessibility to information has become so commonplace that whenever circumstances disallow someone from checking their email account, checking account, or Facebook page on demand, the all-too-common reaction is akin to someone temporarily losing the use of an arm or leg. At first disbelief sets in, then panic, and then a full-fledged determination to regain that connection.

But while our desire to stay stay "in touch" is probably natural, it also raises some concerns about security. After all, if all of the above-mentioned accounts are available to the end user 24-7, might they also be available to crooks as well? In addition, the security of these accounts is largely out of our control; you might use all the due diligence in the world to ensure their security, but what about the person operating the server on the other end?

In the security industry, there have been many attempts to address these concerns. Public key infrastructure (PKI) is one important key in this exploration. So just how safe is your data? Here we take a deeper look at the PKI technology being designed to protect it.

What Is PKI?

Public key infrastructure is that set of hardware, software, personnel and other entities involved with communication via digital certificates. More specifically, a major portion of PKI is a concept known as public key encryption (PKE). This is the backbone of PKI, much like combustible engines are the backbone of the automotive industry; PKE is the essential component that makes PKI work.

Colorful analogies aside, what exactly is PKI/PKE, and how can it provide a security solution? Good question. Public key encryption (sometimes referred to as public key cryptography) consists of authenticating and encrypting messages via the exchange of pubic keys. These public keys are typically referred to as digital certificates. They have a mathematical relationship with an end user’s private key, which is typically based on the Diffie-Hellman cryptographic algorithm or the RSA algorithm, in which the following formula is the starting point for the exchange of public keys between two parties who wish to communicate remotely:

(A*B)^C mod N

Where:
A = End user 1
B = End user 2
C = Session key
N = Prime number

After the mathematical relationship has been established, and after public keys have been exchanged between two or more parties, encrypted communications can (at least theoretically) be exchanged. Plus, all concerned parties can (again, theoretically) authenticate one another via digital signatures.

It sounds so simple doesn’t it? In all seriousness, PKI is actually rather effective and efficient when practiced in environments where a small number of users communicate with one another, but some important issues arise when PKI is implemented within an enterprise.

Public Key Infrastructure Pros and Cons

When implemented correctly, PKI can provide a level of security that is not easily matched by other security solutions. One of the major advantages of PKI that allows for this level of security is a concept known as nonrepudiation. In the context of network security, nonrepudiation simply refers to the idea that two or more users who wish to communicate with one another securely do not have to exchange secret keys, passwords, secret handshakes, or anything else that would otherwise be needed for decrypting a message. This property is due in no small part to the above-mentioned cryptographic algorithms that create the mathematical relationship between public and private key pairs. Basically, each end user is responsible for the confidentiality of his or her private key, whereas other security solutions maintain central repositories where secret keys, passwords, and other such sensitive information is stored.

What is typically referred to as PKI’s major disadvantage is network overhead. The network overhead involved with PKI is considerable when compared to other security solutions. For example, the above-mentioned algorithms in which public and private key pairs are generated and exchanged can sometimes consume large amounts of network resources.

PKI also involves much more than simply exchanging public and private keys. For example, certificate revocation lists (CRLs) must be maintained in order to properly keep track of valid and invalid certificates. In a typical enterprise environment, a certain amount of personnel turnover is a fact of life, and security administrators must have a way to stay current with who is and who is not authorized to access the network. If an end user's employment is terminated within a given organization, it's only common sense that that employee's network access should be revoked. But these CRLs must be stored and maintained somewhere, which means - you guessed it - more network resources are consumed.

The Future of PKI

Currently, public key infrastructure is considered no small chore to implement within private industry. PKI’s complexity, coupled with its initial cost, has discouraged several organizations from taking on the effort. However, the Department of Defense has made a well-documented transition to PKI in recent years, throwing significant time and treasure at the effort. Add to this the number of private contracting companies that rely on doing business with the government’s information security sector and it's easy to get the sense that there's a degree of permanence to PKI.

So is PKI here to stay? It certainly seems that way, and the only scenario that may cause a course reversal would involve a security vulnerability being found, exploited and publicized.