Recent Advances in PKI Technologies
Lin Jing · 2015
The public key infrastructure(PKI) is a typical technology of applied cryptography. In a PKI system, digital certificates are signed by certification authorities(CAs) to bind a PKI user's identity and public key. Then, using the trusted root CA's self-signed certificate, a PKI relying-party verifies the certificate chain of the PKI user,to obtain the PKI user's public key for various security services. In the recent five years, PKI technologies achieved remarkable progress as PKI systems are widely adopted in various scenarios, including:(1) certificate verification and management in SSL/TLS,(2) PKI systems deployed in large-scale applications, and(3) certification revocation solutions. Firstly, about the PKI research related to SSL/TLS, there exist man-in-the-middle attacks due to the vulnerability of certificate verification and the countermeasures; certificate transparency and its follow-ups publicly audit CAs' certificate signing operations, to detect the fake certificates signed by compromised CAs; CA certificate management in PKI clients, is also useful to mitigate the threats from compromised CAs. Secondly, PKI systems are deployed in the large-scale scenarios of cross-border/domain interoperability, ICAO e Passport, IP routing security and DNS security. Finally, recent certificate revocation solutions focus on the applications with special requirements such as RFID, e Passports, key escrow systems and private-mode browsers. This paper surveys the advances of these PKI technologies.