Trust Models

Introduction

Public-key infrastructure (PKI) manages trust in electronic transactions. The principal elements used for maintaining that trust are the contents of the certificates and the security safeguards in effect in the environments of the various parties involved. These two elements are derived by a risk management procedure from the business purpose of the exchanges, as captured in the certificate policy.

Before discussing trust management in PKI, a definition of the word “trust” is required.

Reference [1] defines trust in the following way: “Generally, an entity can be said to “trust” a second entity when it (the first entity) makes the assumption that the second entity will behave exactly as the first entity expects.”

The first entity makes this assumption about a relevant area of the second entity's behaviour, and so the trust between them is limited to that specific area. In PKI the behaviour of interest is related to the distribution and use of public keys for electronic...