An Efficient Method to Merge Hierarchical Public Key Infrastructures

In order to challenge the security threats for e-commerce and e-business transactions, robust and trustworthy security systems are required. Public Key Infrastructure (PKI) is a frame work on which the security services are established. Most of the business corporations deploy Hierarchical PKI as their security infrastructure, in which, certificate path is unidirectional, so certificate path development and validation is simple and straight forward. In this paper, we propose a novel method for certificate path verification in Hierarchical Public Key Infrastructures and compare the experimental results with the existing certificate Path verification methods.KeywordsPKICertification AuthorityHierarchical PKICertificate path verificationCertificate path validation

The Public Key Infrastructure (PKI) can provide various secure services in E-commerce. Once the enterprise changes its collaborators, the multiple PKIs deployed by the enterprise and its new collaborators must be interoperated. Such things often happen especially in the enterprises adopting Enterprise Resource Planning (ERP) system. Considering the specialties of such context, an efficient scheme based on hierarchy structure is proposed. Keeping the previous PKIs integrate and independent, the merging process is quick and low-cost. Furthermore, compared with the common ways like mesh certificate authority model and Bridge certificate authority model, the certificate verification in new PKI is more efficient. In order to precisely describe the scheme, some essential conceptions of PKI are formalized.


 
 
 History of Seal and Printing Cultures Implications of the four important Chinese inventions, the compass, gun powder, papermaking, and printing, have far-reaching significance for human civilisation. The Chinese seal is intimately related to printing. Seals have the practical function of duplicating impressions of words or patterns. This process shares a very similar concept to printing on a small scale. Printing originated from the function of seals for making duplicated impressions, and for this reason Wang believes that seals constitute the prototype of printing. Seals in Traditional Commere Seals in certain Asian countries, such as Taiwan and Japan, play a vital role similar to that played by signatures in Western society. Particularly, the Chinese seal has been an integral part of Chinese heritage and culture. Wong states that seals usually symbolise tokens of promise in Chinese society. Ancient seals in their various forms have played a major role in information systems, in terms of authority, authentication, identification, certified proof, and authenticity, and have also been used for tamper-proofing, impression duplication, and branding purposes. To illustrate, clay sealing has been applied to folded documents to detect when sealed documents have been exposed or tampered with. Interestingly, one of the features of digital signature technology is also designed to achieve this purpose. Wong records that when the commodity economy began to develop and business transactions became more frequent, seals were used to prove that particular goods had been certified by customs. Moreover, when the goods were subject to tax by the government, seals were applied to the goods to prove the levy paid. Seals continue to be used in Chinese society as personal identification and in business transactions, official and legal documents, administrative warrants and charters. Paper-based Contract Signing with Seal Certificates In Taiwan and Japan, in certain circumstances, when two parties wish to formalise a contract, the seals of the two parties must be affixed to the contract. As Figure 1 illustrates, seal certificates are required to be attached to the signed and sealed contract for authentication as well as the statement of intent of a voluntary agreement in Taiwan. Figure 1. Example of a contract attached with the seal certificates A person can have more than one seal; however, only one seal at a time is allowed to be registered with a jurisdictional registration authority. The purpose of seal registration is to prevent seal forgery and to prove the identity of the seal owner. Namely, the seal registration process aims to associate the identity of the seal owner with the seal owner’s nominated seal, through attestation by a jurisdictional registration authority. Upon confirmation of the seal registration, the registration authority issues a seal certificate with both the seals of the registration authority and the registration authority executive. Digital Signatures for Electronic Commerce Handwritten signatures and tangible ink seals are highly impractical within the electronic commerce environment. However, the shift towards electronic commerce by both the public and private sector is an inevitable trend. ‘Trust’ in electronic commerce is developed through the use of ‘digital signatures’ in conjunction with a trustworthy environment. In principle, digital signatures are designed to simulate the functions of handwritten signatures and traditional seals for the purposes of authentication, data integrity, and non-repudiation within the electronic commerce environment. Various forms of Public Key Infrastructure (PKI) are employed to ensure the reliability of using digital signatures so as to ensure the integrity of the message. PKI does not, however, contribute in any way to the signatory’s ability to verify and approve the content of an electronic document prior to the affixation of his/her digital signature. Shortcomings of Digital Signature Scheme One of the primary problems with existing digital signatures is that a digital signature does not ’feel’ like, or resemble, a traditional seal or signature to the human observer; it does not have a recognisably individual or aesthetic quality. Historically, the authenticity of documents has always been verified by visual examination of the document. Often in legal proceedings, examination of both the affixed signature or seal as an integral part of the document will occur, as well as the detection of any possible modifications to the document. Yet, the current digital signature regime overlooks the importance of this sense of visualisation. Currently, digital signatures, such as the OpenPGP (Pretty Good Privacy) digital signature, are appended to an electronic document as a long, incomprehensible string of arbitrary characters. As shown in Figure 2, this offers no sense of identity or ownership by simple visual inspection. Figure 2. Example of a PGP signature To add to this confusion for the user, a digital signature will be different each time the user applies it. The usual digital signature is formed as an amalgam of the contents of the digital document and the user’s private key, meaning that a digital signature attached to an electronic document will vary with each document. This again represents a departure from the traditional use of the term ‘signature’. A digital signature application generates its output by firstly applying a hash algorithm over the contents of the digital document and then encrypting that hash output value using the user’s private cryptographic key of the normal dual-key pair provided by the Public Key cryptography systems. Therefore, digital signatures are not like traditional signatures which an individual can identify as being uniquely theirs, or as a recognisable identity attributable to an individual entity. New Visualised Digital Signature Scheme Liu et al. have developed the visualised digital signature scheme to enhance existing digital signature schemes through visualisation; namely, this scheme makes the intangible digital signature virtually tangible. Liu et al.’s work employs the visualised digital signature scheme with the aim of developing visualised signing and verification in electronic situations. The visualised digital signature scheme is sustained by the digital certificate containing both the certificate issuer’s and potential signer’s seal images. This thereby facilitates verification of a signer’s seal by reference to the appropriate certificate. The mechanism of ensuring the integrity and authenticity of seal images is to incorporate the signer’s seal image into an X.509 v3 certificate, as outlined in RFC 3280. Thus, visualised digital signature applications will be able to accept the visualised digital certificate for use. The data structure format of the visualised digital certificate is detailed in Liu. The visualised signing and verification processes are intended to simulate traditional signing techniques incorporating visualisation. When the signer is signing the document, the user interface of the electronic contracting application should allow the signer to insert the seal from the seal image file location into the document. After the seal image object is embedded in the document, the document is referred to as a ’visually sealed’ document. The sealed document is ready to be submitted to the digital signing process, to be transmitted with the signer’s digital certificate to the other party for verification. The visualised signature verification process is analogous to the traditional, sealed paper-based document with the seal certificate attached for verification. In history, documents have always required visual stimulus for verification, which highlights the need for visual stimulus evidence to rapidly facilitate verification. The user interface of the electronic contracting application should display the visually sealed document together with the associated digital certificate for human verification. The verifier immediately perceives the claimed signer’s seal on the document, particularly when the signer’s seal is recognisable to the verifier. This would be the case particularity where regular business transactions between parties occur. Significantly, having both the issuing CA’s and the signer’s seal images on the digital certificate instils confidence that the signer’s public key is attested to by the CA, as shown in Figure 3. This is unlike the current digital signature verification process which presents long, meaningless strings to the verifier. Figure 3. Example of a new digital certificate presentation Conclusions Seals have a long history accompanying the civilisation of mankind. In particular, certain business documents and government communities within seal-culture societies still require the imprints of the participating entities. Inevitably, the use of modern technologies will replace traditional seals and handwritten signatures. Many involved in implementing electronic government services and electronic commerce care little about the absence of imprints and/or signatures; however, there is concern that the population may experience difficulty in adapting to a new electronic commerce system where traditional practices have become obsolete. The purpose of the visualised digital signature scheme is to explore enhancements to existing digital signature schemes through the integration of culturally relevant features. This article highlights the experience of the use and development of Chinese seals, particularly in visualised seals used in a recognition process. Importantly, seals in their various forms have played a major role in information systems for thousands of years. In the advent of the electronic commerce, seal cultures still remain in the d

The Web public-key infrastructure (PKI) provides a mechanism to identify websites to end users for the purposes of encrypted communication. The security of the Web PKI primarily relies on certification authorities (CAs), trusted parties whose misbehavior can enable man-in-the-middle (MITM) attacks: the impersonation of websites to users, followed by the theft or modification of sensitive information. While many methods of addressing CA misbehavior have been proposed, no solution has been both effective and practical: able to protect websites users against C misbehavior and to be easily deployed and used by all parties involved. Thus, despite more than two decades of research advances, the Web PKI remains largely vulnerable to misbehaving CAs.In this thesis, I argue that we can use minimal changes to existing technology to build deployable solutions thatreduce the rate of successful MITM attacks in the Web PKI. Specifically, I present three projects that exemplifyeffective and practical approaches to improving the Web PKI. In IKP, I use the Ethereum cryptocurrency and smartcontract platform to build an insurance-like mechanism that disincentivizes CA misbehavior. In CAPS, I use twoglobal monitoring and logging systems, CT and Censys, to build a system that strengthens the existing PKI againstmisbehaving CAs and enables the secure incremental deployment of new and improved PKIs for theWeb. In SAINT, I use the SCION future Internet architecture to propose a PKI that unifies public-key authentication for naming, routing, and end-entity public keys in a federated environment, and identify challenges and desired properties in such an environment. Through this work, I provide a first step towards making a more resilient Web PKI a reality.

Public key cryptography can uniquely enable trust within distributed settings. Employing it usually requires deploying a set of tools and services collectively known as a Public Key Infrastructure (PKI). PKIs have become a central asset for many organizations, due to distributed IT and users. Even though the usage of PKIs in closed and controlled environments is quite common, interoperability and usability problems arise when shifting to a broader, open environment. To make an effective trust judgment about a public key certificate, a PKI user needs more than just knowledge of that certificate: she also needs to be able to locate critical parameters such as the certificate repositories and certificate validation servers relevant to that certificate – and all the others the trust path she builds for it. Surprisingly, locating these resources and services remains a largely unsolved problem in real-world X.509 PKI deployment. This issue impacts especially on the usability of this technology and the interoperability of PKIs in open environments such as the Internet. In this paper, we present the design and prototype of a new and flexible solution for automatic discovery of the services and data repositories made available by a Certificate Service Provider (CSP). This contribution will take real-world PKI one step closer to enhancing usability of digital certificates and interoperability between PKIs.

A Public Key Infrastructure (PKI) is security standards to mana ge and use public key cryptosystem. A PKI is used to provide digital signature, authentication, public key encryption functi onality on insecure channel, such as E-banking and E-commerce o n Internet. A soft-token private key in PKI is leaked easily because it is stored in a file at standardized location. Also it is vulnerable to a brute-force password attack as is protected by password-based encryption.In this paper, we proposed a new method that detects private ke y compromise and is probabilistically secure against a brute-force password attack though soft-token private key is le aked. The main idea of the proposed method is to use a genuine signature key pair and () fake signature key pairs to make an attacker difficult to generate a valid signature with probability  even if the attacker found the correct password. The proposed method provides detection and notification functionality when an attacker make an attempt at authentication, and enhances the security of soft-token private key without the additional cost of construction of infrastructure thereby extending the function o f the existing PKI and SSL/TLS.Keywords: Public Key Infrastructure, key compromise detection, certificate revocation, revocation notification 접수일(2014년 6월 3일), 수정일(2014년 9월 11일), 게재확정일(2014년 9월 25일)* 이 논문은 2014년도 정부(미래창조과학부)의 재원으로 한국연구재단-차세대정보・컴퓨팅기술개발사업의 지원을 받 아 수행된 연구임(No. 2010-0020726)†주저자, rudrnrwlska@naver.com‡교신저자, donghlee@korea.ac.kr(Corresponding author)

Today the public key technology enjoys wide acceptance and use. Countless network protocols and applications use it to guarantee strong authentication and privacy. Usability and maintainability of this technology remains problematic, however. It is still very cumbersome and time-consuming to set up an enterprise Public Key Infrastructure (PKI) that has relationships with external parties. The emergence of PKI bridges, while solving one set of problems, created a new one: management of distributed trust became much more difficult. Complexity of the global PKI mesh and its decentralized nature created a need for a service with a unified view of the global PKI. In this paper we propose a PKI search engine that can provide such a service. The engine supports facilities for certificate and certificate revocation list (CRL) discovery, testing and troubleshooting of extra-enterprise PKIs, certificate revocation status lookup, certification path construction and validation, all based on the Internet-mined and user-registered information.

Scaling issues in large PKI communities

PKI(Public Key Infrastructure) provides confidentiality, integrity, and non-repudiation services for etransaction and various countries around the world offer a e-commerce service by using PKI. These PKI technologies can be used in e-transaction between countries like e-trade area. To do this, an interoperability of PKI technology is necessary between different PKI domains. This paper introduces „Asia PKI Interoperability Guideline“ that was developed by the pilot project between Asia countries for Asia PKI interoperability and intends to present the possibility of PKI interoperability between countries.

Public Key Infrastructure (PKI) guarantees secure communication and authentication in digital contexts. With the expansion of digital ecosystems, the ability of PKI systems to work together smoothly becomes increasingly important, allowing multiple trust models to be compatible. Nevertheless, several significant challenges must be overcome when merging different trust models. The current body of research does not thoroughly examine these difficulties in various PKI trust models. This study aims to conduct a comprehensive assessment and analysis of the difficulties related to PKI interoperability. The focus will be on trust models such as Cross Certification, Bridge CA, Hierarchical, Hybrid, Cross Recognition, and Certificate Trust Lists. This systematic literature review (SLR) uses the PRISMA technique to analyse trust models in PKI interoperability. The review focuses on peer-reviewed studies published between 2000 and 2024, ensuring transparency and rigor. Eligibility criteria included studies using quantitative methodologies and sourced from major academic databases. This systematic review identified critical challenges in the interoperability of PKI trust models, particularly in operational complexity, security, liability, and scalability. Trust models like Cross Certification, Bridge CA, and Hierarchical systems each present unique challenges when integrated into diverse digital ecosystems. Moreover, gaps in the current research suggest the need for more standardised, scalable solutions that can accommodate the growing complexity of digital infrastructures. Future research should focus on developing a universal model for PKI interoperability, with a particular emphasis on large-scale environments such as E-commerce and E-government systems.

Non-PKI methods for public key distribution

In public-key encryption, the secrecy of the public key is not required, but the authenticity of the public key is necessary to guarantee its integrity and to avoid spoofing and playback attacks. A user’s public key can be authenticated (signed) by a certificate authority that verifies that a public key belongs to a specific user. In this chapter, digital certificates, which are used to validate public keys, and certificate authorities are discussed. When public-key is used, it is necessary to have a comprehensive system that provides public key encryption and digital signature services to ensure confidentiality, access control, data integrity, authentication, and non-repudiation. That system, public-key infrastructure or PKI, is also discussed in this chapter.

Traditionally, a Certification Authority (CA) is required to sign, manage, verify and revoke public key certificates. Multiple CAs together form the CA-based Public Key Infrastructure (PKI). The use of a PKI forces one to place trust in the CAs, which have proven to be a single point-of-failure on multiple occasions. Blockchain has emerged as a transformational technology that replaces centralized trusted third parties with a decentralized, publicly verifiable, peer-to-peer data store which maintains data integrity among nodes through various consensus protocols. In this paper, we deploy three blockchain-based alternatives to the CA-based PKI for supporting IoT devices, based on Emercoin Name Value Service (NVS), smart contracts by Ethereum blockchain, and Ethereum Light Sync client. We compare these approaches with CA-based PKI and show that they are much more efficient in terms of computational and storage requirements in addition to providing a more robust and scalable PKI.

The Northern Sahara uses groundwater as the only source of drinking water, irrigation and industry. To achieve better exploitation, we suggest implementing a Decision Support System (DSS) to sustain the management of water boreholes in the south of Algeria while exposing the key characteristics of these settlements. Data exchanged in our system is critical and must be secured. This paper presents a digital signature system based on the Public Key Infrastructure (PKI) of the different documents exchanged in the DSS. The cryptographic system was developed with JAVA technology based on PKCS standards (Public Key Cryptographic Standards). To have a PKI server, we have configured the Linux server through an open SSL. The PKI is used for creating users' certificates with their private and public keys.

Identity-based encryption (IBE) is an exciting alternative to public-key encryption, as IBE eliminates the need for a Public Key Infrastructure (PKI). The senders using an IBE do not need to look up the public keys and the corresponding certificates of the receivers, the identities (e.g. emails or IP addresses) of the latter are sufficient to encrypt. Any setting, PKI- or identity-based, must provide a means to revoke users from the system. Efficient revocation is a well-studied problem in the traditional PKI setting. However in the setting of IBE, there has been little work on studying the revocation mechanisms. The most practical solution requires the senders to also use time periods when encrypting, and all the receivers (regardless of whether their keys have been compromised or not) to update their private keys regularly by contacting the trusted authority. We note that this solution does not scale well -- as the number of users increases, the work on key updates becomes a bottleneck. We propose an IBE scheme that significantly improves key-update efficiency on the side of the trusted party (from linear to logarithmic in the number of users), while staying efficient for the users. Our scheme builds on the ideas of the Fuzzy IBE primitive and binary tree data structure, and is provably secure.