Multivendor PKI the key to smooth e-business communications

BUILDING TRUST in the confidentiality of Internet transactions is one of the most important and yet most challenging issues facing the growth of e-business. Why is trust important? Multimillion-dollar transactions and highly sensitive company documents are traveling across a public network. Some companies let business partners or customers access information directly from their internal applications, using the Internet as the infrastructure. The sensitivity of these communications makes ensuring the authenticity, integrity, and confidentiality of the transactions extremely important.

PKI (public key infrastructure) is the technology of choice for building trust via the Internet, but implementing PKI is not trivial. Ensuring the interoperability of multivendor PKI environments is the key to building trust in e-business transactions.


PKI is a security infrastructure that uses public and private key pairs to ensure the authentication, integrity, and confidentiality of communications. Within this infrastructure, users are given their own public/private key pair to use when conducting business transactions. Usually, the user's public key is stored on a digital certificate.

A digital certificate is the electronic equivalent of an identification card, such as a driver's license. The certificate contains identifying information about the user, such as name and e-mail address. The certificate also contains the user's public key -- information that uniquely identifies the user and is similar to a driver's license number. This digital certificate can be used to strongly authenticate a user to a system and to encrypt e-mail messages and other types of communications.

The key component of a PKI is the CA (certificate authority). The CA can be seen as the independent third party in a PKI. The CA is responsible for creating, distributing, and revoking digital certificates, binding a public key value to a person, computer, or entity via a process called certification. CAs are organized in a hierarchy in which each parent CA signs a certificate vouching for a subordinate CA's public key. The verification process starts with a user's certificate and proceeds upward via the certificate path until a certificate can be verified by a higher-level CA. The difficult part comes when companies want to communicate with one another via the use of PKI for authentication and trust.

PKI interoperability has been a problem for quite some time. When PKI products were first developed, vendors used proprietary protocols, making interoperability almost impossible. The development of the PKIX (public key infrastructure and X.509) standards and X.509 certificate standards have greatly increased interoperability. The obstacle that remains is establishing trust.

One company, Xcert, has focused significantly on building trust relationships between CAs and provides the most flexible trust relationships I have seen on the market today (see our ).

Why do you want to establish trust between CAs? The most common reason is to allow user authentication for extranets; companies want to use the cost advantages provided by the Internet and give their customers and partners access to information on their internal networks. You can issue certificates to every person who has access to the network. But what about those partners or customers that already have a certificate issued by their company's CA? End-users do not want to manage multiple certificates. Can they use their existing certificate to authenticate to the partner company's network? The answer is yes, but it can be a cumbersome process.

To make things work, you need to enable interoperability -- that is, communication -- between CA hierarchies. They must be able to retrieve and verify the validity of each hierarchical CA.

For example, John works for company A, which runs a hierarchy of CAs. Heather works for company B, which has a single CA using the same CA vendor as does company A. You would think companies A and B could easily interoperate because both use software made by the same vendor, but this is not the case. There is no link of trust between CAs in these two hierarchies. Users or CAs in either company cannot verify one another's certificates because they have no mutual point of direct trust.

One solution to the problem is to use the hierarchical model within each company and have the top CAs securely exchange their public keys; this is known as the direct-trust model. You then have to make the public key of each top CA available to the entire hierarchy for the other CA. This process is cumbersome, especially when it becomes necessary to revoke the trusted keys.

A better solution is to have the top CA for company A sign a certificate vouching for the public key of B's top CA. This model, known as cross-certification, still requires an out-of-band exchange of certificates, which can delay impatient users, but it is done only once, and the rest of the verification process remains the same. You can also create a cross-certificate for A, signed by B's top CA.

Now, when Heather receives a message from John, she follows the certificate path to A's top certificate. She then verifies that certificate by using A's cross-certificate, which is available at company B and bears the signature of B's top CA, for which Heather has direct trust.

Notice that cross-certificates are needed even if the two hierarchies use CAs made by the same vendor. If two CAs from different vendors are to interoperate, an additional complication arises. The format and extensions of certificates used by both vendors is not specified in enough detail in the X.509 standard to ensure interoperability. Modifications to both sides may be necessary.

The main problem here arises in certificate extensions. If one CA is using extensions not supported by the other for critical information, the entire PKI may need to be redesigned, which is a very time-consuming and expensive process.

Certificate interoperability is essential for long-term benefits and for the use of digital certificates within e-business environments because companies want to have the flexibility to interoperate with different CA hierarchies.

PKI is a complex technology, but vendors are working hard to make it easier to deploy and administer. The cost savings provided by the Internet clearly override the complexity of building a PKI environment.