# Comparison of Distributed Tamper-Proof Storage Methods for Public Key Infrastructures
###### Abstract  
Modern Public Key Infrastructures (PKIs) allow users to create and maintain centrally stored cryptographic certificates. These infrastructures use a so-called certificate chain. At the root of the chain, a root Certification Authority (CA) is responsible for issuing the base certificate. Every verification and certification step within the chain is based upon the security of said root CA. Thus, its operation security is of great concern. Since the root certificates are stored locally on the root CA, any Denial of Service (DoS) attack may render the whole certificate chain, which is based on of the attacked root CA, inoperable. Therefore, this article evaluates different approaches to a decentralized data storage system that is based on the Distributed Ledger Technology (DLT). To show the real-world potential of the proposed approaches, we also evaluate the different technologies using a novel PKI mechanism called Near Field Communication Key Exchange (NFC-KE). The results indicate that modern distributed data storage solutions such as Interplanetary Filesystem (IPFS) and SIA can have significant performance and decentralization benefits in comparison to purely Blockchain-based technologies like Hyperledger Fabric. However, they lack any Smart Contract functionality, which requires a software developer to implement verification mechanisms in centralized software solutions. Public Key Infrastructures; decentralized data storage; blockchain data storage; Certification Authority; decentralized trust; public key cryptography +
Footnote †: journal:  
certification chains have a length of two to four CAs and thus allow for a robust and secure digital trust relationship that forms the basis of modern web traffic. This system has three significant problems that are under current research [1; 2; 3]: First, the chain of trust is based on the trust for the root CA. This trust is artificially generated, e.g., by the developers of modern Web browsers and operating systems that store the root certificates in the default keychain of the system. These certificates need to be trusted implicitly. Second, the maintenance effort for establishing and running a custom certification chain is beyond the scope of competencies of most Small and Medium Enterprises (SMEs). These enterprises often do not own a proper IT department to establish such a certification chain and are therefore depending on a proper solution provided by external contractors. The third problem is an inherent flaw in the design of the root CA and its centralized, on-device keystore. If a root CA has been compromised, the attacker has potential access to the file system and all of its files and certificates. This allows, in the worst case, for tampering of the certificate contents or maliciously uploaded certificates that are not properly issued. In cases when a formerly well-intended CA turns out to be fraudulent, the same above problems arise. The Distributed Ledger Technology (DLT) offers a solution for problems one and three by using its decentralized execution and data storage concepts and, when combined with a lightweight Public Key Infrastructure (PKI) approach, also a potential real-world applicable solution for problem two. Therefore, we chose to adapt the Near Field Communication Key Exchange (NFC-KE) PKI scheme, which offers a lightweight public key exchange scheme. This scheme is particularly suited for SMEs since it does not require a certification chain for its operation. Most research on the general topic of DLT-based CAs is focusing on novel protocol approaches for diversifying the realm of new signature verification techniques, aided by, e.g., Blockchain platforms [4; 5; 6]. A general pattern evolved among these works, showing that popular DLT frameworks like Hyperledger Fabric (HLF) [5] or Ethereum [6] are valid candidates for successfully implementing those novel PKI approaches.