X.509 and Certificate Authorities (CAs)
Solution:
- Have a trusted third-party (“certificate authority” (CA)) authenticate the advertisement of a public key. Eg: Verisign
- The CA digitally signs the public key advertisement: creates a “X.509 certificate”
- Issues: (“Public Key Infrastructure (PKI)”)
- CA should guard its private key closely
- CA does background checks on customers.
- CA can provide several "grades" of certificates.
- Certificate registration (CA's public key) security
- Scalability: need multiple, distributed CAs !