1 XML Key Management Specification XKMS Dr Phillip Hallam-Baker FBCS CEng. VeriSign Inc.

2 The Trust Model Problem PKI is the interface between the Internet and the Real World –Real World Trust Relationships are complex Scale breaks simplifying assumptions used to make PKI tractable –Simple PKI Hierarchy (PEM) –Everyone is a trust provider (PGP)

3 FBCA PKI Topology Federal Government Bridge CA –Not a simple hierarchy –Not a completely random assembly –Knowledge of structure greatly helps use –How to get to ubiquitous COTS support Bridge Agency CA 1 Bob Agency CA 2 Alice

4 Traditional PKI Alice Bob Directory ASN1PKIX ASN1PKIX

5 XKMS PKI Interface Alice Bob Directory ASN1PKIX XKMS ASN1PKIX XML

6 XKMS PKI Interface Alice Bob Directory XKMS ASN1PKIX XML Directory XKMS ASN1PKIX XML

7 XKMS Services Key Information Service –I need a key to talk S/MIME to Locate – Not a Trusted Service Validate – Trusted Service Key Registration Service –Key lifecycle management Registration Reissue Revocation Recovery

8 Summary XKMS is one example of a Web Service –Moving complexity from client to server reduces Deployment costs Deployment cycle time Development costs Management costs