PKI

/piː keɪ aɪ/ · Abbreviation · Security & Infosec

Definitions

  1. PKI, or Public Key Infrastructure, is the framework of hardware, software, policies, and procedures that manages the creation, distribution, storage, and revocation of digital certificates used for secure communication. At its core, PKI uses asymmetric cryptography: each entity has a public key (shared openly) and a private key (kept secret). Certificate Authorities (CAs) are trusted third parties that verify identities and issue digital certificates binding a public key to an entity. When you visit an HTTPS website, your browser validates the site's certificate against trusted root CAs stored in the browser or operating system. The chain of trust extends from root CAs through intermediate CAs to end-entity certificates. PKI enables HTTPS, email encryption (S/MIME), code signing, VPNs, and document signing. Certificate revocation is handled through Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP). Let's Encrypt democratized PKI by providing free, automated certificates.

    In plain English: The whole system of digital certificates, keys, and trusted authorities that makes secure internet connections possible — it's what puts the padlock icon in your browser's address bar.

Etymology

1976
Diffie and Hellman's public-key paper implies the need for a 'public file' of keys — the seed of PKI
1988
ITU-T publishes X.509, defining the certificate format that underpins all modern PKI
1995
Netscape introduces SSL certificates for web commerce, making PKI invisible infrastructure for billions of users
2015
Let's Encrypt launches free automated certificates, encrypting the majority of web traffic within five years

Origin Story

The Trust Infrastructure That Secures the Digital World

PKI, or Public Key Infrastructure, is the framework of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. It is the foundation upon which HTTPS, email encryption, code signing, and countless other security systems rest. The mathematical basis came from Whitfield Diffie and Martin Hellman's landmark 1976 paper 'New Directions in Cryptography,' which introduced public-key cryptography. Ron Rivest, Adi Shamir, and Leonard Adleman followed with the RSA algorithm in 1977, providing a practical implementation. However, public-key cryptography alone did not solve the trust problem: how do you know that a public key actually belongs to who it claims to? PKI answered this with certificate authorities (CAs), trusted entities that vouch for the binding between a public key and an identity by issuing digitally signed certificates. VeriSign, founded in 1995 as a spin-off of RSA Security, became the first major commercial CA. The X.509 certificate standard, originally defined in 1988 for the ITU's directory services, became the universal format. Today, PKI underpins virtually all secure internet communication, with a hierarchy of root CAs, intermediate CAs, and end-entity certificates forming a chain of trust that browsers verify millions of times per second worldwide.

Context: Built on Diffie-Hellman (1976) and RSA (1977) cryptography; formalized through X.509 certificates and commercial CAs in the 1990s.

Fun fact: In 2011, the Dutch certificate authority DigiNotar was compromised by hackers who issued fraudulent certificates for google.com and other domains, allowing man-in-the-middle attacks on Iranian Gmail users. The breach led to DigiNotar's bankruptcy and prompted the creation of Certificate Transparency, a public log system that makes misissued certificates detectable.

Related Terms