PKI, The What, The Why, and The How

This paper discusses Public Key Architecture (PKI) and why governments are introducing legislation for information privacy. If this paper achieves its aim, it should leave the reader with the impression that for an organization to set up its own complete infrastructure is no trivial matter. It is left as an exercise for the reader to determine that acquisition costs are significant, but hopefully it is shown that the life cycle costs, especially for facilities providing Identity Certificates can be huge. Those organizations that cannot justify the resources to supply their own PKI in house, can probably justify a level of outsourcing the infrastructure, or even relying on 3rd Party accredited commercial facilities. If a level of outsourcing still cannot be justified, then there is a very good chance that there are no business drivers for using PKI. For those organizations that can justify using PKI, the paper offers guidelines in determining an appropriate architecture.