PKI -An Industry Perspective Lisa Pretty Executive Director

PKI Forum “ The PKI Forum is an international, not-for- profit, multi-vendor and end-user alliance whose purpose is to accelerate the adoption and use of Public-Key Infrastructure (PKI). The PKI Forum advocates industry cooperation and market awareness to enable organizations to understand and exploit the value of PKI in their e-business applications.”

PKI is the Future! u Predictions for the overall market are huge. –Both IDC and Frost & Sullivan put PKI as one of the fastest growing markets in the Internet security space in coming years. –According to Aberdeen Group, 98% of the Global 2000 enterprises will be using PKI before 2003.

Source: Datamonitor, “Public-Key Infrastructure ”, December 1999 PKI Market Forecast, by Revenue Category

What will it take? u Top Inhibitors of PKI deployment –Lack of Multi-vendor Interoperability –Minimal understanding of PKI –Complexity of Installation & Deployment

PKI Interoperability u Three different aspects to PKI interoperability –Component interoperability –Enterprise interoperability –Application interoperability

PKI Component Interoperability u Ability to mix and match COTS PKI products u Depends upon specification-based messages exchanged between components to support: –Certificate requests –Certificate renewal –Certificate revocation CA RA Client Repository

Enterprise Interoperability u The ability to connect two enterprise PKIs into a larger functional PKI –More than just cross- certification –Clients must be able to find and validate meaningful certification paths Enterprise A PKI CARA Client Repository A Enterprise B PKI CARA Client Repository B

Application Interoperability u The ability of PKI-aware applications to: –Share PKI certificates, key-pairs, and processing modules –Rely on different PKI environments to implement security services Enterprise A PKI CARA Client Repository A Enterprise B PKI CARA Client Repository B

Projects Underway u Technical Working Group –CA-CA Interoperability –Application Certificate Interoperability –CMP Interoperability –Token Portability & Interoperability –White Paper - Interoperability –White Paper - Critical Path Construction –White Paper - LDAP

Business Working Group u Education & Marketing u Applications u Best Practices u Policy & Privacy

Policy/Legislative Principles 1. Promote “product neutral” not “technology neutral” rules. 2. Discourage rules that implicate an inherent equivalency of signature technologies. 3. Advance validity and enforceability of PKI system rules, user agreements,certificates, and digital signatures. 4. Advance government recognition and use of private sector-based PKI guidelines and standards.

Principles (con’d) 5. Promote basic/minimum PKI "default rules“ 6. Advance both authentication and privacy benefits of PKI. 7. Eliminate restrictions on import/export of crypto. 8. Address and harmonize consumer use / rights / obligations.