The second step is to create simple interfaces to these mid-tier services. Here, XML can play a significant role. These additions to the PKI model obviously make sense. Many applications will use XML as a base encoding format for accessing and manipulating a variety of services and data types. Thus, bringing PKI into the XML fold is a natural step in the effort to simplify how applications access and use not just PKI, but all security services.
Standards are, of course, essential.
Today there are no standards for such a model. Microsoft, VeriSign and WebMethods have discussed their ideas on how some of these functions should work with XML Key Management Services, which they hope to move into the W3C standards process. As is the case with all standards efforts, there are likely to be some political snags along the way as vendors argue over approaches that play to their strengths and minimize their weaknesses. But the market is demanding such a solution. Until PKI can provide an easier way to enable applications, its potential benefits will remain hostage to the problems associated with the technology's current complexity.