Wanted: PKI interoperability

Server-based certificates are in wide use on the Web to verify that servers are truly what they claim to be. But adoption of digital certificates by organizations for widespread e-commerce use remains clouded for several reasons, including a lack of interoperability among vendors' public-key infrastructure (PKI) offerings.

In an effort to address interoperability concerns, several vendors - including VeriSign, Microsoft, IBM, WebMethods, Entrust Technologies, Baltimore and Hewlett-Packard - last week announced plans to support a new XML-based key-management specification dubbed XKMS.

Different vendors' PKI software for certificates, certificate authorities and validation servers built to the XKMS specification would, in theory, have no difficulty exchanging and validating certificates across hosted Web-based PKI services.

That has yet to be proven, though, and will require many XKMS product "bake-offs" to ensure interoperability, said Brian O'Higgins, Entrust's CTO, last week at the RSA Conference in San Francisco.

"XKMS is now on a standards track at the Worldwide Web Consortium," O'Higgins said.

Completion of the XKMS standard suite and the interoperable products based on it are probably two years out, O'Higgins said.

But vendors are already showcasing XKMS prototypes on their Web sites. Entrust, for example, has posted at its site what it calls an XKMS "Web services responder."

XKMS resources from Entrust

Network World on Security
Sign up for our free e-mail newsletter.

Breaking PKI news