Public-key infrastructure technology was once so cool. Its combination of encryption, digital certificates and other technologies appeared to be a foolproof way to ensure the security of electronic transactions. It gave agencies the tools they needed to replace paper documents with electronic ones and paved the way for electronic government.

Sometimes, though, when organizations look more closely at deploying PKI, the technology loses its allure. Instead of finding a universal remedy, many agencies have become mired in the taxing policy and technical issues that come with PKI. Encryption techniques rely on randomly generated keys that must be mapped to user identities using digitally signed documents called certificates. Managing those certificates — developing policies and processes to issue and revoke them efficiently — is an enormously complex and expensive task that has hampered many agency efforts to build their own PKIs.

[ Read more ]

Related items

• Review: Understanding PKI: Concepts, Standards, and Deployment Considerations 2/e (23 January 2003)