Public Key Infrastructure (PKI)
Definition
The system of hardware, software, policies, and standards that manage digital certificates and public-key encryption. Provides the trust architecture underpinning all cryptographic electronic signatures: key pairs, Certificate Authorities, X.509 certificates, and revocation mechanisms.
- Core components
- Key pairs, Certificate Authorities, X.509 certificates, revocation lists
- Function
- Manages digital certificates and public-key encryption
- Underpins
- Cryptographic electronic signatures
Common questions
How does PKI establish trust in a digital signature?+
A Certificate Authority verifies the signer's identity and issues an X.509 certificate binding a public key to that identity, so a signature can later be verified by tracing the certificate chain up to a trusted root.
What happens when a certificate is compromised?+
It is added to a Certificate Revocation List or checked via OCSP, allowing relying parties to detect and reject signatures made with the compromised key after its revocation date.
Related terms
- Aadhaar E-Sign
- India's authentication-linked electronic signature service in which the user's Aadhaar biometric or OTP authentication triggers the generation of a short-validity signing certificate...
- ESIGN Act (Electronic Signatures in Global and National Commerce Act)
- US federal legislation (2000) providing that no electronic signature may be denied legal effect solely because it is in electronic form. Technology-neutral:...
- EU Trusted List (EUTL)
- The authoritative list maintained by the European Commission listing all Trust Service Providers per EU member state that are supervised to issue...
- Long-Term Validation (LTV)
- A PDF signature profile (PAdES-LTV, ETSI EN 319 102-1) in which the OCSP responses, CRL data, and TSA certificate chain information are...
- OCSP (Online Certificate Status Protocol)
- A real-time certificate revocation protocol in which the verifier queries the CA's OCSP responder with the certificate's serial number and receives a...
- QSCD (Qualified Signature Creation Device)
- A hardware or remote HSM-based device that stores the signer's private key such that it cannot be extracted, ensuring sole control under...
- Qualified Electronic Signature (QES)
- The highest tier of electronic signature under EU eIDAS Regulation 910/2014. Created by a Qualified Signature Creation Device (QSCD), backed by a...
- TSA Timestamp (Timestamp Authority)
- A cryptographically protected record of the time at which a signature was created, issued by a Timestamp Authority (TSA) whose own certificate...
- X.509 Certificate
- A digitally signed data structure that binds a public key to a named identity (subject) and is issued by a Certificate Authority....