On June 22, 2001, the American Bar Association’s Information Security Committee (ISC) (Section of Science and Technology) released the PKI Assessment Guidelines — PAG v0.30 Public Draft for Comment (“PAG”), a comprehensive and detailed document that addresses the technical, legal, business, and policy issues related to public key cryptography and provides guidelines for assessing public key infrastructures. PKI, or Public Key Infrastructure, is a system utilizing public key cryptography, that when combined with a well-implemented infrastructure, provides a level of security for communicated and stored data sufficient to justify trust in such information by business, consumers, governments, and the courts. “Assessment” in the context of the PAG refers to the process of determining whether a PKI satisfies a set of defined criteria, such as commercial standards, regulatory requirements, and requirements for trust mark licensure. The following article is intended to summarize the introduction section of the PAG and identify issues that are global in scope with respect to the establishment, operation, and administration of a PKI.
Read full abstract