PEM provides a range of security features. Each of these will be discussed in turn. Central to the PEM authentication framework are certificates, which contain items such as the digital signature algorithm used to sign the certificate, the subject's Distinguished Name , the certificate issuer's Distinguished name, a validity period, indicating the starting and ending dates the certificate should be considered valid, the subject's public key along with the accompanying algorithm. This hierarchical authentication framework has four entities. It is responsible for certifying and reviewing the policies of the entities in the next lower level.
Individual users are on the lowest level of the hierarchy.
This hierarchical approach to certification allows one to be reasonably sure that certificates coming users, assuming one trusts the policies of the intervening CAs and PCAs and the policy of the IPRA itself, actually came from the person whose name is associated with it. This hierarchy also makes it more difficult to spoof a certificate because it is likely that few people will trust or use certificates that have untraceable certification trails, and in order to generate a false certificate one would need to subvert at least a CA, and possibly the certifying PCA and the IPRA itself. Message Confidentiality Message confidentiality in PEM is implemented by using standardized cryptographic algorithms. For asymmetric key management, the RSA algorithm is used. In order to provide data integrity, PEM implements a concept known as a message digest.