5.1 Introduction

In answer to the question: 'So when are PKIs actually going to happen, then?', the simple reply is that they already have. They are well established and, indeed, not only is there a thriving PKI industry occupied by both technology suppliers and service suppliers, but these established high-technology companies are quickly consolidating to gain market share.

A better question to ask might be: 'Is a contemporary PKI a technology or a service?' The answer is the latter. PKI suppliers are positioning themselves to offer trusted certification authority services that allow their customers to procure bolt-on PKI security components. This permits application and service providers to focus on their strengths in their own markets.

Although the whole field of public key infrastructure (PKI) still has many unanswered, and very complex, problems to be resolved, the most fundamental misconception is the basic definition of a PKI it is a public key 'infrastructure'. This highlights the fact that the cryptographic technology is relatively unimportant and that a PKI as an infrastructure is not, and never will be, a stand-alone application in its own right.

The main strength of a PKI is that it can offer a scalable security solution component for any of the various connectivity layers (application, transport and network). A PKI is powered by cryptography that is under constant critical public review regarding algorithms and key sizes while also enjoying significant visibility within the global legal communities. Many national and international digital...