# Presentation: 028590

## XML Key ManagementSpecification (XKMS)

- April 2001

**Notes:**
Logo for VeriSign.

## Recent Developments

- XML Signature standard proposal completed
- XML Encryption companion standard in development
- Industry collaborators announce compatible key management specification
- XML key management specification (XKMS )

## PKI Application Enablement

- It has been difficult and costly to interface applications to PKI service infrastructures
- Proprietary PKI-vendor toolkits typically needed
- Complex functions need to be embedded in applications
- Need different solution for different infrastructures
- XML presents opportunity to incrementally and easily add PKI services to applications

## PKI Second Generation

- Deployed either...
- Fully embedded (e.g., DOCSIS); or
- Applications see simple, standard plug-and-socket
- Menu of application-oriented functions
- Register this public key!
- Give me the assured public key for this signature!
- Verify this signature!
- Is this signer authorized?
- Notarize this transaction!
- Any complexity hidden *under the hood* in the infrastructure
- Transparent to the user

## X.509/PKIX PKI Model

**X.509/PKIX PKI Model**

**PKI**

** **

**PKI **

**Provider**

** **

**Private key**

** **

**Public key**

** **

**ASN.1 Based**
**Protocol**

** **

**Key Pair Holder**

** **

**Relying Party**

** **

**Public keys**

** **

**ASN.1 processing**
**X.509 certificate parsing**
**Path construction**
**Path validation**
**Revocation checking**
**Trust model processing**
**PKCS/CMP/CMC/CEP/CRS/LDAP/OCSP**

**App-integrated**
**PKI Functions**

**Registration**

**Directories**

**?**

**Other**
**service**
**provider**

**Application**
**Product**

**Notes:**
Application Product consists of:
Key Pair Holder - Private Key, Public Key (clip art of a PC & a man typing on a keyboard, red key, gray key).
Relying Party – clip art of a file server.
App-integrated PKI Functions – ASN.1 processing, X.509 certificate parsing, Path construction, Path validation, Revocation checking, Trust model processing, PKCS/CMP/CMC/CEP/CRS/LDAP/OCSP.

The Key Pair Holder interfaces with the PKI Provider (clip art of two file servers and a Public keys database). Labeled “Registration”.
The Relying Party and App-integrated PKI Functions interfaces with the PKI Provider, Directories, and Other service provider.

## Offloading X.509-Processing

- OCSP
- Offloads revocation status checking to a server
- OCSP-X or SCVP
- Offload (or delegate) X.509:
- Certificate path discovery (DPD); and/or
- Certificate path validation (DPV)
- Simplifies the processing functions that app needs to incorporate, but app still needs to understand X.509 certificates, paths, and ASN.1

## XKMS Model

**XKMS Model**

** **

**Private key**

** **

**Public key**

** **

**XML**

** **

**Key Pair Holder**

** **

**Relying Party**

** **

**Assertion Server**

** **

**Registration Server**

**Public keys**

**Application**
**Product**

***Register my public key!***

***Give me the public***
*** ******key I need!***

**?Unspecified?**

**Notes:**
Application Product – clip art of a PC & man typing on the keyboard, a red colored private key, and a gray colored public key (labeled Key Pair Holder).
Registration Server, Relying Party, and Assertion Server – clip art of a file server.

The Key Pair Holder interfaces via XML with the Registration Server.
The Relying Party interfaces via XML with the Assertion Server.
Public keys are unspecified.

## XKMS - Simple Configuration

**XKMS - Simple Configuration**

** **

**Private key**

** **

**Public key**

** **

**XML**

** **

**Key Pair Holder**

** **

**Relying Party**

** **

**Assertion Server**

** **

**Registration Server**

**Application**
**Product**

***Register my public key!***

***Give me the public***
*** ******key I need!***

**PKI**

** **

**PKI **

**Provider**

** **

** **

**Public keys**

** **

**Notes:**
Application Product – clip art of a PC & man typing on the keyboard, a red colored private key, and a gray colored public key (labeled Key Pair Holder).
Registration Server, Relying Party, and Assertion Server – clip art of a file server.
PKI Provider – clip art of two file servers, two databases, and three gray colored public keys.

The Key Pair Holder interfaces via XML with the Registration Server.
The Relying Party interfaces via XML with the Assertion Server.
The Registration Server and the Assertion Server interface with the PKI Provider.

## XKMS - Complex Configuration

**XKMS - Complex Configuration**

** **

**Private key**

** **

**Public key**

** **

**XML**

** **

**Key Pair Holder**

** **

**Relying Party**

** **

**Assertion Server**

** **

**Registration Server**

**Application**
**Product**

***Register my public key!***

***Give me the public***
*** ******key I need!***

**PKI**

** **

**PKI **

**Provider 1**

** **

**PKI **

**Provider 2**

**Bridge**
**CA **

**Notes:**
Application Product – clip art of a PC & man typing on the keyboard, a red colored private key, and a gray colored public key (labeled Key Pair Holder).
Registration Server, Relying Party, and Assertion Server – clip art of a file server.
PKI Provider 1 and PKI Provider 2 – clip art of a file server and database.
Bridge CA – clip art of a file server.

PKI Provider 1, Bridge CA, and PKI Provider 2 all interfaces with each other.

The Key Pair Holder interfaces via XML with the Registration Server.
The Relying Party interfaces via XML with the Assertion Server.

The Registration Server and the Assertion Server interface with the PKI Provider 1, the Bridge CA, and the PKI Provider 2.

## Multi-PKI Backend Using XKMS

**Multi-PKI Backend Using XKMS**

**Certification Authority**
**(X-KRSS or traditional PKI)**
** ****registration service)**

**Client App**

**FI’s Identrus**
**Certification**
**Authority**

**Business to Business**
**Interactions**

**Identrus Root,**
**  ****other root,**
**bridge, or relationship**

**Purchaser**** **
**(Certificate Holder)**

**Acquiring**
**Financial Institution**

**Issuing FI**
**(or other **
**credential issuer)**

**B2B Portal**
**(Relying Party)**

**HSM**

**DSMS**

**XKMS**

**XKMS**

**XKMS**

**XKMS**

**X-KISS**
**Service**

**FI’s Private**
**Certification**
**Authority**

**Foreign**
**Certification**
**Authority**

**Notes:**
Clip art of a Federal building with seven columns is labeled as:
Certificate Authority (X-KRSS or traditional PKI) registration service, FI’s Identrus Certification Authority, FI’s Private Certification Authority, and Foreign Certification Authority.

## XKMS Status Summary

- Developed by VeriSign, Microsoft, webMethods
- Supported by IBM, HP, iPlanet, Baltimore, Entrust, RSA, IONA, PureEdge, Evincible, Citigroup, Reuters, SAIC, CIBC
- Submitted to W3C with proposal to formally standardize

## Interoperability Programs

- Developer site: www.xmltrustcenter.org
- VeriSign SDK available for download
- Trial service available for developers
- Several vendors participating in informal interoperability testing
- Evincible XKMS application demonstrated at RSA 2001

## Summary - XKMS Characteristics

- Compatible with X.509 PKI
- But not necessarily bound to that type of underlying PKI
- Can transparently support arbitrarily complex underlying trust/policy structure, e.g.: Federal Bridge CA
- Compatible with XML Signature & Encryption, XML Protocol
- Application product:
- Must implement sign/verify ops and manage private key
- Must generate and process limited XML transactions
- No ASN.1 or X.509 chain processing
- Extensible
- Example: Attribute information delivered with public key
- Can work in conjunction with services like SAML
- Broad industry support - open standard