PKI, firewalls and VPNs
Two common criticisms of public-key infrastructure are that digital certificates authenticate only the holder's identity, not the holder's access rights, and that PKI does nothing to encrypt communications.
Although work is underway to develop access control using PKI attribute authorities, firewalls remain the conventional means of access control, while VPNs remain the standard means of ensuring privacy through encryption.
Actually, VPNs and PKI are complementary; one doesn't replace the other. The Internet Key Exchange elements of the IP Security standard recommend the use of digital certificates for authenticating requests to set up secure sessions. This is preferable to static authentication methods, such as using preshared keys, because session partners don't require prior knowledge of one another's secret keys to set up a tunnel.
PKI and firewalls are less complementary when it comes to access control. While few seriously advocate eliminating firewalls from the security arsenal, PKI offers three benefits over firewalls.
First, digital certificates record the identity of every user of a given service. The implications for capacity planning, marketing and security auditing are obvious.
Second, certificates have the advantage of portability, in that a user can come from anywhere. In contrast, firewalls typically grant access only to specific IP addresses, networks or domains.
Finally, revocation can be distributed much more quickly with certificates. In the firewall case, updating access policies requires changes to the rule sets of dozens or even hundreds of devices. In contrast, PKI relies on certificate revocation lists stored on centralized certificate authorities. Revoking one certificate or even 1 million certificates only needs to be done once.
On the downside, using digital certificates requires PKI-awareness by every resource a user wants to reach. And integrating PKI into mission-critical applications and network equipment is a daunting task. A number of service bureaus focus specifically on this problem, but the current low rate of PKI adoption is attributable mainly to the complecxity of integration issues.
RELATED LINKS
Newman is president of Network Test, an independent benchmarking and network design consultancy in Westlake Village, Calif. He can be reached at dnewman@networktest.com.
Newman is also a member of the Network World Global Test Alliance, a cooperative of the premier reviewers in the network industry, each bringing to bear years of practical experience on every review. For more Test Alliance information, including what it takes to become a member, go to www.nwfusion.com/alliance.
PKI: Build, buy or bust?
Options abound for digital certificates, but so do security concerns and design headaches.
What is PKI anyway?
Any PKI design is only as secure as its weakest component. Therefore, good PKI design requires a thorough understanding of all the components.
Whom do you trust?
Questions to ask potential PKI vendors
The ABCs of PKI
Decrypting the complex task of setting up a public-key infrastructure.
Network World, 01/17/2000.
Wanted: PKI interoperability
Adoption of digital certificates by organizations for widespread e-commerce use remains clouded for several reasons, including a lack of interoperability among vendors' public-key infrastructure (PKI) offerings.
Network World, 04/16/01.
