📖 What is Public Key Infrastructure (PKI)?
Public Key Infrastructure (PKI) is a system of hardware, software, policies, and procedures used to create, manage, distribute, use, store, and revoke digital certificates. It provides the foundation for secure electronic transfer of information via asymmetric encryption.
"Student, be very clear on the role of the Registration Authority (RA) versus the Certificate Authority (CA) for the exam."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Public Key Infrastructure (PKI)?
- ▸ The Certificate Authority (CA) acts as the trusted third party responsible for issuing, signing, and managing the lifecycle of digital certificates.
- ▸ The Registration Authority (RA) handles the identity verification process, ensuring the requester is who they claim to be before the CA signs the certificate.
- ▸ Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP) provide mechanisms to invalidate certificates before their scheduled expiration date.
- ▸ The Chain of Trust establishes a hierarchy where a Root CA signs intermediate CAs, which in turn sign end-entity certificates for users or devices.
- ▸ Asymmetric encryption provides the mathematical foundation, using a public key for encryption or verification and a private key for decryption or signing.
🎯 How does Public Key Infrastructure (PKI) appear on the CISSP Exam?
You may be asked to identify which component is responsible for verifying a user's identity documents before a certificate is issued, requiring you to distinguish between the RA and the CA.
A scenario might describe a need for real-time certificate validation to avoid the latency and bandwidth issues associated with downloading large CRL files, pointing toward OCSP.
Expect questions about a compromised private key where you must determine the correct administrative action to prevent further unauthorized use of the associated digital certificate.
❓ Frequently Asked Questions
What is the primary difference between CRL and OCSP?
CRLs are lists of revoked certificates downloaded periodically, which can become outdated. OCSP provides a real-time request/response mechanism to check the current status of a single certificate instantly.
Why use an Intermediate CA instead of signing everything with the Root CA?
This adds a layer of security. If an Intermediate CA is compromised, it can be revoked without needing to replace the Root CA, which would otherwise invalidate the entire trust hierarchy.
How does PKI ensure non-repudiation?
By using the sender's private key to create a digital signature, PKI ensures that the sender cannot deny sending the message, as only they possess that unique private key.