Myth: PKI technology is not yet mature.
We need to wait for standards and products to stabilize.
Reality: PKI standards and products are clearly in a
state of flux. But the same is true of many information technology standards and products.
Although interoperability between different PKI domains is a challenge, out-of-the-box
software or services currently support intra-agency operations such as personnel
management applications. Many products even support multiple domains operating under a
Federal agencies have started or planned dozens of pilots that deploy digital
certificates for hundreds or thousands of users. PKI applications supporting public
Internet transactions with federal agencies are also on the drawing boards.
The bottom line is that PKI products work well in limited environments, and they are
growing more versatile and robust. Using those products is the best way to cause the
technology and standards to further mature and stabilize.
Myth: Other forms of authentication,
such as digitized signatures, are better than digital signatures.
Reality: Biometric identifiers such as digitized
signatures by themselves do not provide the data in-tegrity of digital signatures.
Further, the technologies are not mutually exclusiveusing a biometric identifier
such as a fingerprint to unlock a private key on a smart card is perhaps the strongest
authentication mechanism available.
Myth: PKI technology is not
interoperable, so it is at best a local solution.
Reality: This is only partly true today. Within the
federal government alone, we are developing a Bridge Certification Authority which will
allow PKIs in different agencies to interoperate in an efficient and concise way. The
bridge can also serve as a conduit to external PKIs. Although much work is still to be
done, there are no speed-of-light limitationsthe biggest concerns are about policy
and law. By contrast, systems using personal identification numbers are not interoperable
today and not likely to become so tomorrow.
Myth: You need PINs to unlock private
signature or decryption keys, so why do you need PKI technology as well? Why not just use
PINs over Secure Sockets Layer connections?
Reality: This is my fa-vorite misconception. Using SSL
means you are using a form of PKI technology. More importantly, however, a PIN with PKI
technology presents a means to authenticate yourself to your hard disk or smart card.
Using a PIN over an SSL link means you are using a shared secret between yourself and a
remote host, so someone else knows and has access to it. An end-user PKI gets you the best
of all worldsend-user to end-user authentication, data integrity, technical
nonrepudiation and confidentiality.
Myth: Digital signatures can be
Reality: Generalize the statementanything can be
Digital signatures provide technical nonrepudiationthat is, if the cryptography
is done properly, a public key will only validate a signature made by the corresponding
private key. Generate and keep the private key on a hardware token, protect it with a
biometric identifier, and you have a pretty strong case in courtfor those few
situations that hinge on a persons signature, digital or otherwise.
Only PKI aficionados would argue that PKI technology is appropriate for all needs. Most
of us believe one size doesnt fit all.
In evaluating how to provide authentication and security for an application, you should
always start with the question: What are the risks you are seeking to abate?
Draft guidance promulgated by the Office of Management and Budget on March 5, 1999,
focuses on this point.
The guidance implements the Government Paperwork Elimination Act, a statute that
compels agencies to accept electronic forms and use electronic signatures, a superset of
digital signatures, for authentication. Visit gits-sec.treas.gov to read a copy and
provide comments during the 120-day comment period.
The guidance recognizes that for many applications, PINs over SSL with Message
Authentication Codes might work fine; biometrics or digitized signatures also might work
But the guidance also recognizes that the solution that today appears to offer the best
authentication, security, data integrity, technical nonrepudiation, and potential for
scalability and interoperability is public-key technology.
Richard A. Guida is the Government Information Technology Services Boards
security champion and head of the Federal Public-Key Infrastructure Steering Committee.