# A Blockchain-Based Decentralized Public Key Infrastructure Using the Web of Trust
###### Abstract  
Internet applications rely on Secure Socket Layer (SSL)/Transport Security Layer (TSL) certifications to establish secure communication. However, the centralized nature of certificate authorities (CAs) poses a risk, as malicious third parties could exploit the CA to issue fake certificates to malicious web servers, potentially compromising the privacy and integrity of user data. In this paper, we demonstrate how the utilization of decentralized certificate verification with blockchain technology can effectively address and mitigate such attacks. We present a decentralized public key infrastructure (PKI) based on a distributed trust model, e.g., Web of Trust (WoT) and blockchain technologies, to overcome vulnerabilities like single points of failure and to prevent tampering with existing certificates. In addition, our infrastructure establishes a trusted key-ring network that decouples the authentication process from CAs in order to enhance secure certificate issuance and accelerate the revocation process. Furthermore, as a proof of concept, we present the implementation of our proposed system in the Ethereum blockchain, confirming that the proposed framework meets the five identified requirements. Our experimental results demonstrate the effectiveness of our proposed system in practice, albeit with additional overhead compared to conventional PKIs. decentralized PKI; X.509; blockchain; Ethereum; smart contract; web of trust (WoT) +
Footnote †: journal: Cybersecurity and Privacy  
* The existing system's distribution of revocation information is characterized by time-intensive processes and sluggish verification, which can result in prolonged revocation times during breaches [7]. * The lack of transparency in the current system enables CAs to issue certificates for individual domain owners without the parent company's knowledge [8], potentially leading to the creation of counterfeit sites. Several mechanisms have been proposed to mitigate the issue of compromised CAs, as well as time-intensive revocation problems. These approaches have their own advantages and disadvantages compared to other schemes. One of the most popular approaches is the log-based schema [9, 10], notably Certificate Transparency (CT) by Google, which detects fraudulent certificates and misbehaving CAs using a public log server to store and disseminate certified public key certificates, ensuring transparency and the ability to identify malicious activity. Alternative methods such as segmented CRL and Delta-CRL [11], as well as Pushing Revocation to Dependers [12], address challenges in certificate status distribution. Concurrently, various proposals have emerged advocating for a decentralized PKI, utilizing blockchain technology to enhance its infrastructure [13, 14, 15, 16, 17, 18, 19]. The centralized PKI used by existing CAs poses risks such as a single point of failure, lack of transparency, and vulnerability to adversaries, allowing a compromised CA to issue legitimate certificates for anonymous domains [8, 20, 21]. While a considerable amount of research is dedicated to swiftly detecting malicious attacks and compromised certificates, we adopted a different approach to address the underlying issues of a centralized PKI, particularly the problem of a single point of failure. This study proposes a novel decentralized PKI that integrates a distributed verification system by leveraging blockchain and WoT [22] technologies. A high-level overview of the proposed system, incorporating blockchain and the WoT, is illustrated in Figure 1. The WoT technology facilitates the creation of a key-ring network comprising trusted entities responsible for authenticating certification information. The involvement of multiple members in the verification process eliminates single points of failure and Man-in-the-Middle (MitM) attacks [23], accelerates the revocation process, and the blockchain's append-only feature based on Markel Tree Hash enhances data transparency and public auditability.