LOCALPKI: A User-Centric Formally Proven Alternative to PKIX

Abstract

A public-key infrastructure (PKI) binds public keys to identities of entities. Usually, this binding is established through a process of registration and issuance of certificates by a certificate authority (CA) where the validation of the registration is performed by a local registration authority. In this paper, we propose an alternative scheme, called LOCALPKI, where the binding is performed by the local authority and the issuance is left to the end user or to the local authority. The role of our third entity is then to register this binding and to provide up-to-date status information on this registration. The idea is that many more local actors could then take the role of a local authority, thus allowing for an easier spread of public-key certificates in the population. We also prove our scheme's security with Tamarin an automatic verification tool of cryptographic protocols.