PKI: it's not dead, just resting

Gutmann, Peter

doi:10.1109/mc.2002.1023787

Cited by 146 publications

(60 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In traditional PKI, this assurance is delivered in the form of a signed certificate from a trusted authority [35]. However, there are many issues with PKI associated with certificate management, including key storage, distribution and revocation, as outlined in [36]. Popular E2E-encrypted tools (e.g., iMessage, WhatsApp, Signal) relieve users of key management; they simply query a trusted server that vouches for the authentic public keys of other users.…”

Section: A Secure Communicationsmentioning

confidence: 99%

Obstacles to the Adoption of Secure Communication Tools

Abu-Salma

Sasse

Bonneau

et al. 2017

2017 IEEE Symposium on Security and Privacy (SP)

112

View full text Add to dashboard Cite

Abstract-The computer security community has advocated widespread adoption of secure communication tools to counter mass surveillance. Several popular personal communication tools (e.g., WhatsApp, iMessage) have adopted end-to-end encryption, and many new tools (e.g., Signal, Telegram) have been launched with security as a key selling point. However it remains unclear if users understand what protection these tools offer, and if they value that protection. In this study, we interviewed 60 participants about their experience with different communication tools and their perceptions of the tools' security properties. We found that the adoption of secure communication tools is hindered by fragmented user bases and incompatible tools. Furthermore, the vast majority of participants did not understand the essential concept of end-to-end encryption, limiting their motivation to adopt secure tools. We identified a number of incorrect mental models that underpinned these beliefs.

show abstract

Section: A Secure Communicationsmentioning

confidence: 99%

Obstacles to the Adoption of Secure Communication Tools

Abu-Salma

Sasse

Bonneau

et al. 2017

2017 IEEE Symposium on Security and Privacy (SP)

112

View full text Add to dashboard Cite

show abstract

“…In a traditional Public Key Infrastructure (PKI), this assurance is delivered in the form of certificate, essentially a signature by a Certification Authority (CA) on a public key [1]. The problems of PKI technology are well documented, see for example [16]. Of note are the issues associated with certificate management, including revocation, storage and distribution and the computational cost of certificate verification.…”

Section: Introductionmentioning

confidence: 99%

Certificateless Public Key Cryptography

Al-Riyami

Paterson

2003

Lecture Notes in Computer Science

1,561

1,315

View full text Add to dashboard Cite

Abstract. This paper introduces and makes concrete the concept of certificateless public key cryptography (CL-PKC), a model for the use of public key cryptography which avoids the inherent escrow of identitybased cryptography and yet which does not require certificates to guarantee the authenticity of public keys. The lack of certificates and the presence of an adversary who has access to a master key necessitates the careful development of a new security model. We focus on certificateless public key encryption (CL-PKE), showing that a concrete pairing-based CL-PKE scheme is secure provided that an underlying problem closely related to the Bilinear Diffie-Hellman Problem is hard.

show abstract

“…PKI is based on Public Key Cryptography discovered by Diffie & Hellman (1976) combined with certification of public keys as proposed by Kohnfelder (1978). An exhaustive presentation of the evolution and principles of PKI is found for example in (Gutmann, 2002). PKI is a basis for two-factor authentication and digital signature services.…”

Section: Background and Related Researchmentioning

confidence: 99%

Mobile Certificate Based Network Services

Pulkkis

Yazdani

2013

IISIT

View full text Add to dashboard Cite

The deployment of mobile certificates in Finland, the related Application Provider's Interface (API), and also the design, management, and use of a Mobile Signature Service (MSS) is described. The role of a mobile certificate in a Public Key Infrastructure (PKI) is outlined and some related research is presented. ETSI (European Telecommunications Standards Institute) standards for MSS implementations and FiCom (The Finnish Federation for Communications and Teleinformatics) application guidelines for these standards are presented. MSS implementation details are shown for user authentication and for electronic signing of plain text. A step-by-step user experience of an implemented MSS combining user authentication with electronic signing of plain text is presented in an Appendix A. A list of abbreviations and definitions is in Appendix B.

show abstract

PKI: it's not dead, just resting

Cited by 146 publications

References 7 publications

Obstacles to the Adoption of Secure Communication Tools

Obstacles to the Adoption of Secure Communication Tools

Certificateless Public Key Cryptography

Mobile Certificate Based Network Services

Contact Info

Product

Resources

About