Internet2 PKI Labs

Research Agenda Possibilities



1. PKI research

a. Denial of service attacks on directories and online CA's, and especially how to deal with such attacks - e.g., local caching of certificates and CRLs.

b. Prevention of the addition of rogue crypto modules on the fly, or more broadly: "How to prevent or detect the addition of malicious code into platforms that perform PKI services - CAs, RAs, directories - so that those services can remain trustworthy."

c. Alternatives to CRL’s. A number of alternatives to CRL’s are being developed to address certificate revocation . The scaling properties of these approaches are not understood, nor are testbeds available to evaluate these options.

d. Protocols to support secure transfer of trust roots to clients, or more broadly: "How to transport securely the public keys of root CAs (without or without self-signed root certificates), and ensure those public keys remain unchanged after installation on an end-user's platform."

e. Use of policy objects with certificates, and the management (construction and validation) of complex trust chains (varying over context and time). Also, the ability to do trustworthy policy mapping between disparate PKI domains issuing certificates under different certificate policies."


  1. Open Source Enhancements

a. New libraries and modules in open source code will be needed to implement the evolving protocols and mechanisms of PKI.


3. Related directory services


a. Development of uniform access control model for access to directories in general, and to specific information within those directories (granular control).

b. Analysis of the efficiencies in chaining versus referrals for the finding and processing of trust paths.



4. Authorization


a. Authorization likely has a number of connections to PKI, from transport of policy oids to attribute certificates. Research topics could include: