A Public Key Infrastructure (PKI) is a group of technologies used to request, create, manage, store, distribute, and revoke digital certificates. If you’re planning on taking the Security+ exam, you should have a good understanding of PKI components.
For example, can you answer this question?
Q. An organization is planning to implement an internal PKI for smart cards. Which of the following should the organization do FIRST?
A. Install a CA.
B. Generate key pairs.
C. Generate a certificate.
D. Identify a recovery agent.
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Exploring PKI Components
A Public Key Infrastructure (PKI) is a group of technologies used to request, create, manage, store, distribute, and revoke digital certificates. Asymmetric encryption depends on the use of certificates for a variety of purposes, such as protecting email and protecting Internet traffic with SSL and TLS. For example, HTTPS sessions protect Internet credit card transactions, and these transactions depend on a PKI.
A primary benefit of a PKI is that it allows two people or entities to communicate securely without knowing each other previously. In other words, it allows them to communicate securely through an insecure public medium such as the Internet.
For example, you can establish a secure session with Amazon.com even if you’ve never done so before. Amazon purchased a certificate from VeriSign. The certificate provides the ability to establish a secure session.
A key element in a PKI is a Certificate Authority.
Certificate Authority
A Certificate Authority (CA, pronounced “cah”) issues, manages, validates, and revokes certificates. In some contexts, you might see a CA referred to as a certification authority, but they are the same thing. CAs can be very large, such as VeriSign, which is a public CA. A CA can also be very small, such as a single service running on a server in a domain.
Public CAs make money by selling certificates. For this to work, the public CA must be trusted. Certificates issued by the CA are trusted as long as the CA is trusted.
This is similar to how a driver’s license is trusted. The Department of Motor Vehicles (DMV) issues driver’s licenses after validating a person’s identity. If you want to cash a check, you may present your driver’s license to prove your identity. Businesses trust the DMV, so they trust the driver’s license. On the other hand, if you purchased an ID from Gibson’s Instant IDs, businesses may not trust it.
Although we may trust the DMV, why would a computer trust a CA? The answer is based on the certificate trust path.
Certificate Trust Paths and Trust Models
CAs are trusted by placing a copy of their root certificate into a trusted root CA store. The root certificate is the first certificate created by the CA that identifies it, and the store is just a collection of these root certificates. If the CA’s root certificate is placed in this store, all certificates issued by this CA are trusted.
The following figure shows the Trusted Root Certification Authority store from Internet Explorer. You can see that there are many certificates from many different CAs. VeriSign is a popular CA, so I scrolled down to show root certificates from VeriSign.
Trusted Root Certification Authorities
Public CAs such as VeriSign negotiate with web browser developers to have their certificates included with the web browser. This way, any certificates that they sell to businesses are automatically trusted.
The most common trust model is the hierarchical trust model, also known as a centralized trust model. In this model, the public CA creates the first CA, known as the root CA. If the organization is large, it can create child CAs. A large trust chain works like this:
- The root CA issues certificates to intermediate CAs.
- Intermediate CAs issue certificates to child CAs.
- Child CAs issue certificates to devices or end users.
In a small organization, the root CA can simply issue certificates to the devices and end users. It’s not necessary to have intermediate and child CAs.
Another type of trust model is a web of trust or decentralized trust model, sometimes used with PGP and GPG. A web of trust uses self-signed certificates, and a third party vouches for these certificates. For example, if five of your friends trust a certificate, you can trust the certificate. If the third party is a reliable source, the web of trust provides a secure alternative. However, if the third party does not adequately verify certificates, it can result in the use of certificates that shouldn’t be trusted.
Q. An organization is planning to implement an internal PKI for smart cards. Which of the following should the organization do FIRST?
A. Install a CA.
B. Generate key pairs.
C. Generate a certificate.
D. Identify a recovery agent.
Answer is A. A Public Key Infrastructure (PKI) requires a certification authority (CA), so a CA should be installed first. Smart cards require certificates and would be issued by the CA.
After installing the CA, you can generate key pairs to be used with certificates issued by the CA.
A recovery agent can be identified, but it isn’t required to be done as a first step for a CA.