InformationWeek.com

Welcome Guest. | Log In| Register | Membership Benefits

June 28, 1999

InternetView:
PKI Needs Support

By Jason Levitt

artnerships can make or break new technologies. A few weeks ago, DIVX, the Circuit City venture that aims to create a standard for rentable Digital Video Disks, died a lingering and painful death. The retailer and its few partners knew that if they couldn't get the major movie studios to accept their "standard," DIVX wouldn't fly. And it didn't help that DIVX was confusing and appeared to be a competitor to DVD, even though it wasn't.

One of the morals here is that companies with common strategic goals must come together to support promising new technologies, whether Internet-related or not. When they do, even as a nonprofit entity, they're in a better position to educate customers and bring standards to the industry. This is especially true when the technologies involved are new and potentially confusing. The ADSL Forum and the Application Service Provider Industry Consortium are two good examples of business alliances that came together to educate the public and promote standards.

There's currently no alliance supporting standards for public key infrastructure--technology for establishing a secure method for exchanging information--but there should be. And it should include PKI vendors such as Baltimore, Entrust, GTE Cybertrust, IBM, Microsoft, Netscape, and Verisign.

After spending time delving into the complex abyss of PKI, I can say with some certainty that the technology is more confusing than either ADSL or ASP, and it suffers from the same lack of customer awareness. Someday, digital certificates, certificate authorities, directory servers, PKI-ready applications, and other components that comprise a PKI may be straightforward to deploy and transparent to users--but right now, they aren't. Yet certain segments of the computer industry have to rely on PKI because some businesses need strong authentication in their enterprises.

Analysts predict that companies will spend billions of IT dollars on PKI over the next five years. Since security of many IT departments is riding on the deployment of PKI, the success and usefulness of a PKI consortium is assured. So just where is this nonaligned forum that unites PKI vendors, providing a single point of entry for IT customers? It's still a pipe dream.

Entrust Technologies, arguably the front-runner in mindshare among PKI vendors, seems content with its user group and yearly user conference, though a couple of their VPs that

I talked to recently did show an interest in the concept of a consortium. My guess is that they won't move on the idea unless others take the initiative. Any takers?