As promised in the “Benefits of PKI” posting last week, tonight’s posting will go over some of PKI’s pitfalls…
To say that PKI is all powerful and without flaws would be a fallacy. In reality, PKI has many blemishes which make managing it that much more difficult. The most glaring of these is the difficulty that is associated with managing certificate and key lifecycles. Hmmmm… let me rephrase that. There really isn’t any concept of centralized certificate or key management. For the most part, CAs are a bunch of dead beat dads and requesters are left to their own devises when it comes to managing certificates and keys.
Luckily, many different people have felt the pain and solutions have been developed to work around this minor little issue. For example, Microsoft has Certificate Lifecycle Manager, Sun has their iPlanet CMS product, RSA used to have something called OneStep, etc. In addition, new concepts like auto-enrollment and credential roaming have emerged which can ease some of the pain. But… in my opinion, the options and solutions are still far from mature because of the difficulty (pain) that is still associated with deploying most of these solutions and making them interoperable with one’s overall IT infrastructure. It’s no wonder that a lot of people are giddy at the ease of deploying Rights Management Services (RMS).
Another PKI drawback is the fact that very few software developers actually follow X.509 standards. I can’t tell you how many times I’ve seen certificate based authentication put into place to meet some sort of compliance requirement. Only to find out later that the application using the certificate based authentication didn’t even check the validity of the certificates it was being given. Err…. “Hey I got an X.509 certificate; you must be a valid user” (Please see my post titled: “An open letter to poorly written software…” for why this bothers me so much).
Next, up… CRLs… I don’t even know where to begin with these things. In concept, 20 years ago CRLs would have worked fine. The problem is that CRLs where never designed for scale or for handling transactional based processes. So, when CRLs are deployed into large environments a whole host of problems emerge. For example, there can be a delay from when a certificate is revoked, to the CRL being published, to the client downloading the new CRL. Additionally, CRL checking can in many respects cause a DDOS for the hosts hosting the distribution points and services that require up-to-date revocation information. This list can go on… Luckily, a solution does exist and its name is the Online Certificate Status Protocol (OCSP). Once developers start supporting it (more) or Vista and Windows Server 2008 deployments hit critical mass we will all be saved!
Finally, our last pitfall are the organizations themselves which don’t manage or understand their PKI deployments. Granted this isn’t a problem with PKI. But, in reality, failure to correctly deploy or manage a PKI is why they tend to fail so horribly.
Hopefully these postings have been helpful… feel free to ask any questions or even post comments. :>)
