# A Blockchain-Based Decentralized Public Key Infrastructure Using the Web of Trust
## 5 System Overview
### System Architecture
#### 5.2.3 X.509 Certificate Creation  
An X.509v3 certificate introduces an extension field, providing a standardized and generic method for including additional information. This flexibility in the extension field enables the addition of multiple signatures, smart contract information, and trust levels, among other features, as illustrated in Figure 5.  
In contrast to the conventional CA hierarchy, the proposed certificate format diverges from the traditional path, eliminating the need to maintain a certificate path from the issuing or intermediate CA to the root CA [1]. Instead of a single signature from a certificate authority, the proposed format mandates multiple signatures, each obtained from the introducer, who verifies the certificate content. This approach significantly reduces the probability of issuing certificates to illegitimate users, as compromising multiple introducers presents a substantially greater challenge compared to compromising a single  
Figure 4: A representation of a key-ring network with each member’s depth and trust level. CA. As previously mentioned, an X.509v3 certificate contains some extra information on extension fields, as follows:  
* **Multiple Signatures:** Accommodates signatures from multiple introducers. * **Certificate Trust Level:** Contains the trust level calculated using Equation (1) during certificate validation. * **Transaction ID:** This is a unique ID for blockchain transactions and is used to fetch certificate-related information from the blockchain network. * **Introducer Identifier:** This identifier is used as a unique address to identify introducers in key-ring smart contracts. Abstract Syntax Notation One (ASN.1) [11] serves as a standard interface description language (IDL) for defining data structures and is employed to accommodate the proposed custom extension field. The ASN.1 structure encompasses an extension identifier, a signature algorithm, a signature value, and a critical flag. The critical flag denotes the significance of the extension information. If the flag value is true, the verifying application must recognize the extension; otherwise, the certificate cannot be accepted. However, an application can ignore the extension field if it is not marked as critical. For the proposed system, the extension field is utilized to support multiple signatures signed by introducers. It is imperative that this extension be marked as critical to ensure recognition by web browsers. Below is the pseudo-ASN.1 structure with notations and the textual description outlining the proposed extension field for X.509v3. bCertInfo EXTENSION ::= {  SYNTAX BCertInfoSyntax  IDENTIFIED BY id-ce-bCert }  
BCertInfoSyntax ::= SEQUENCE SIZE (1..MAX) OF\"BCertInfoSequence  
BCertInfoSequence ::= SEQUENCE {  cA BOOLEAN DEFAULT TRUE,  signatureAlgorithm AlgorithmIdentifier({SupportedAlgorithms},  signatureValue BIT STRING }  
multiSignExtension OBJECTIDENTIFIER ::= {joint-iso-itu-t asn1(1)  ber-derived(2)  
Figure 5: X.509v3 format with multiple signatures and blockchain information in the extension field. distinguished-encoding(1)} id-ce OBJECTIDENTIFIER ::= multiSignExtension id-ce-bCert OBJECTIDENTIFIER ::= {id-ce bCertKey} bCertKey ::= INTEGER(0..MAX) ```  
Each extension is linked with an Object Identifier (OID), as defined in X.509, which serves to identify the extension. This OID is part of the _id-ce arc_. The _signatureAlgorithm_ field indicates the identifier for the cryptographic algorithm employed by the introducers to sign the X.509 certificate. Distinguished Encoding Rules (DER) encoding is utilized here to define the signature context. The _signatureValue_ field contains the digital signature encoded in the ASN.1 DER as BIT STRING. Details of this field are provided in RFC3279 [38], RFC4055 [39], and RFC4491 [40]. For multi-signature extension _multiSignExtension_, the OID of the ASN.1 DER encoding is defined in the ITU-T X.680 standard [41].