# A Blockchain based PKI Validation System based on Rare Events Management
## 3 Existing Solutions
Its relationship with CAs must also be regularized by explicit agreements, so that the trust broker can transfer the responsibility to a CA when a false recommendation is made resulting from incorrect information provided by the CA. The tasks that the trust broker has to perform are not simple to implement and maintain centrally. In this context a new class of blockchain-based solutions emerged. The starting point is the distributed ledger paradigm, which is used to secure a transaction [12; 13]; there is no single point where secure data are stored. Data are shared between many users in a distributed, peer-to-peer network. This means that an attacker has to corrupt at least a significant fraction of them, and this is not easy. Many papers have proposed a blockchain to enforce PKIs [3; 4; 5; 10; 14; 15; 16] where the goal is to carry out efficient certificate validation and solve problems related to CRLs and to the existence of many CAs. Reference [10] analyzed log-based PKIs in an approach to protect PKI publishing CA logs. The paper suggested that log-based PKIs require a centralized, consistent source of information to operate securely when analyzing these logs (for example, to recognize that more than one entity received the same certificate). In particular, there are no incentives to synchronize CA logs and to capture misbehavior. The Ethereum blockchain is described in [10] as a decentralized architecture to provide natural financial incentives and a transaction framework to participants. The work does not address full X.509 certificate parsing since this is prohibitively expensive on Etherum and does not measure processing speeds. In [14], the authors designed and developed a blockchain-based PKI management framework for issuing, validating, and revoking X.509 certificates. In particular, this blockchain-based PKI framework supports the revocation of a certificate, which is a real issue in traditional PKI systems. Moreover [14], as it is impossible to delete information from the blockchain, only a parent CA can mark a certificate issued by him as revoked. Thus, any misbehavior of a CA regarding certificate revocation will be also traced and noticed by all other entities. In [15], the approach is the same: the proposal is a solution in which multiple CAs share a public, decentralized, and robust ledger where CRLs are collected. Reference [16] investigates a web-of-trust based PKI Model. The approach is interesting, but in many ways has already been outdone by the developments around distributed and self-sovereign identity management solutions, which do not have the privacy limitations of this approach. The paper does not address X.509 certificates or processing times. Reference [5] presents a bootstrapped, Bitcoin-like blockchain protocol relying on proofs of work and shows theoretically how this could be used to bind public keys to identities \"while guaranteeing that the majority of them are assigned to honest parties\". A PKI based on this approach does not provide most features of X.509 based PKIs. No practical implementation was realized, nor were estimates of processing speeds provided. The common limitation of these approaches [3; 4; 5; 10; 14; 15; 16] is that they propose a cooperative platform that works if all CAs agree. This is a very strong assumption that requires a set of common rules provided by another party that defines under what conditions a CA is accepted into the blockchain. While promising, none of the proposed solutions have been implemented in such a way that actual X.509 certificates were processed to solve the trust management problem discussed above. Additionally, no performance benchmarks were carried out to assess whether processing speeds were realistic.