An Analysis of XKMS Yamini Ghadge Shanky Subramanian

Agenda Why XKMS? – Problems with PKI What XKMS? Before XKMS After XKMS Advantages XKRSS XKISS Conclusion

Why XKMS? – Problems with PKI Burden is on the Client to perfom expensive operations -- ASN.1 encoding /decoding -- Signature verification -- Chain Validation -- Revocation Checking Interfacing application to PKI service -- Proprietary PKI vendor toolkits -- need of complex functions -- incompatibility with different PKI vendors

What is XKMS? XML Key Management Specification. A Trust Service solves the client deployment problem by shielding the client from the complexity of the underling PKI. Not bound to a particular PKI

Before XKMS

After XKMS

Advantages Ease of Management Less complex application Application is free from ASN.1 0r X.509 processing Very small client footprint. Deployment of new PKI features does not require deployment of new clients.

Components of XKMS XML Key Registration Service Specification (XKRSS) Mechanism for registering a key pair with the service provider Client - generates a key pair and provides the public key, along with other information, to the service provider for registration. XKMS service - generates a key pair for the client, registers the public key of the pair with itself, and sends the private key of the pair to the client for its use. XKMS service keeps the private key as well in case the client loses its private key.

Components of XKMS XML Key Registration Service Specification (XKRSS) XKRSS defines 4 operations Register – public key with some information Reissue – previously generated key binding reissued when new credentials are added to PKI Revoke – allows clients to destroy data objects to which key is bound. Ex. X.509 certificate bound to the XKMS key destroyed when revoke is called. Recover – client recovers the lost private key only if registered with the service provider

Components of XKMS XML Key Information Service Specification (XKISS) Mechanism that allows client applications to authenticate encrypted/signed data. This is done by passing the corresponding key information to service provider. Service provider responds with “ true” or “false” "True" indicates that the public key corresponding to the private key used for signing belongs to the claiming entity.

Components of XKMS XML Key Information Service Specification (XKISS) XKISS defines 2 operations Locate – Finds the key based on element in the key information that is associated with XML encryption or XML signature Validate – It not only finds the key as locate does but also validates the key binding information associated with it.

Conclusion XKMS is a web service that provides interface between XML application and PKI It simplifies deployment of enterprise PKI by transferring complex processing tasks from client application to a trust service .