A01 chaf6542 06 se fm indd

Certificate authorities (CAs)

For secure e-commerce, there is a requirement for the management of the vast number of 

public keys. This management involves procedures and protocols necessary throughout the 

lifetime of a key – generation, dissemination, revocation and change – together with the 

administrative functions of time/date stamping and archiving. The successful establishment 

of a CA is an immense challenge of trust building and complex management. There are two 

opposing views on how that challenge should be met:

● 

Decentralised: market driven, creating  brand-  name-  based ‘islands of trust’ such as the 

Consumers Association. There is a practical need for a local physical office to present cer-

tificates of attestable value, e.g. passports, drivers’ licences. Banks and the Post Office have 

a huge advantage.

● 

Centralised: in the UK, the Department of Trade and Industry (DTI) has proposed a hier-

archical tree leading ultimately to the government.

The  best-  known commercial CA is Verisign (

www.verisign.com

) and this is commonly used 

for merchant verification. Post Offices and telecommunications suppliers are also acting as 

CAs. Examples in the UK include BT (Trust Wise) and the Post Office (ViaCode).