What is a PKI?

PKI (Public Key Infrastructure) refers to the group of technical solutions based on public-key cryptography.

Public-key cryptosystems make it possible to bypass the need to systematically use a secure channel to exchange keys. However, large-scale publication of public keys needs to be made based on complete trust to make sure that:

• The public key indeed belongs to its owner;
• The key's owner is trustworthy;
• The key is still valid.

As such, the two-part key (public key/private key) needs to be associated with a certificate issued by a trusted third party: public key infrastructure.

Concept of trusted third party

The trusted third party is an entity commonly called a certification authority (abbreviated CA) that is responsible for ensuring the truthfulness of information contained in the public key certificate as well as its validity.

To do so, the authority signs the public key certificate with its own key by using the principle of digital signatures.

Role of public key infrastructure

The role of public key infrastructure is multiple and covers the following areas among others:

• recording key requests by verifying the requesting parties' identity;
• generating key pairs (private key/public key);
• guaranteeing the confidentiality of private keys corresponding to public keys;
• certifying the relation between each user and his public key;
• revoking keys (if lost by their owner, if their validity period has expired or if compromised)

Structure of a PKI

A public key infrastructure is generally made of two separate entities:

• The recording authority (abbreviated RA), in charge of administrative formalities such as verifying requesting parties' identity, monitoring and managing requests, etc.);
• The certification authority (abbreviated CA), in charge of technical tasks involved in creating certificates. The certification authority is therefore responsible for certificate signing requests (abbreviated CSRs and sometimes called PKCS#10, the name of the corresponding format). The certification authority is also responsible for signing certificate revocation lists (CRLs);
• The Repository, whose job is to keep certificates in a secure place;