Currently all of the network is using PKI standards and we are facing many problems. I don't mean
every time and if new technologies arise we will also have to face the same, but for my curiosity.
Are there any alternative technologies available which completely don't use the approach of PKI?
-
"the network" = "the internet" ?– user49075Commented Feb 21, 2015 at 19:04
-
for both of them.– user45475Commented Feb 21, 2015 at 19:07
-
What else is "the network"?– user49075Commented Feb 21, 2015 at 19:08
-
I mean to say here, Over the internet and intranet network we are working with PKI. So If i get solutions for both of them. I will be very happy.– user45475Commented Feb 21, 2015 at 19:10
-
Do you mean [an alternative way to have PKI] or [an alternative to using PKI]?– user49075Commented Feb 21, 2015 at 19:55
|
Show 4 more comments
2 Answers
The identifying characteristic of PKI (public key infrastructure) is that it requires certificate authorities, which can be a problem if they abuse the trust given to them.
There are some alternatives to the problem of verifying the owner of a public key without CAs, most of them are based on some sort of collective effort to establish trust, but currently most are not used in practice:
- Trust on first use: just trust the owner when they first give you their key. An example for this is SSH.
- Web of trust: decentralize the verification. An example is PGP.
- Simple public-key infrastructure
- Blockchain Based (pdf): decentralized PKI, based on collective trust
- DNS-based Authentication of Named Entities (DANE)
- if practical, you can always use a different channel (such as classical mail, or personal contact)
-
Sorry. The answer looks like to solve the PKI trust problem. My question is an alternative approach to PKI Commented Feb 21, 2015 at 19:52
-
-1, since one could just refer to "CAs" for that purpose.– user49075Commented Feb 21, 2015 at 19:53
-
1@RickyDemer but CAs are what makes a PKI a PKI. If you are searching for alternatives for a PKI, you can't have CAs. Or the other way around: If you get rid of CAs, you don't have a PKI anymore, which is what the question asked. If what user45475 wants is an alternative to public key cryptography, the question is poorly phrased, as public key crypto is different from public key infrastructure. Or am I missing something completely?– timCommented Feb 21, 2015 at 19:57
-
I certainly agree with "If you are ... can't have CAs." However, "If you get rid of CAs, you don't have a PKI anymore" would make the term "PKI" pointless.– user49075Commented Feb 21, 2015 at 20:06
-
No. instead of CA issuing certs to make a PKI. Can we avoid and get the same level of trust by using any other approach ? Commented Feb 21, 2015 at 20:08
The alternative to public key would be symmetric key for encryption.
Usually they are combined together but if you have a trusted way of sharing the keys then you don't need PKI. However that in itself is a hard problem.
answered Feb 22, 2015 at 14:10
