Simple public-key infrastructure

<h2 id="history-and-overview">History and overview</h2>
<p>The original SPKI had identified principals only as <a href="/facts/Public_key/gowoFTxS">public keys</a> but allowed binding authorizations to those keys and delegation of authorization from one key to another. The encoding used was attribute:value pairing, similar to <a href="/facts/RFC_(identifier)/esftTvE7">RFC</a> <a href="https://www.rfc-editor.org/rfc/rfc822">822</a> headers.
</p><p>The original SDSI bound local names (of individuals or groups) to public keys (or other names), but carried authorization only in <a href="/facts/Access_Control_List/t38J9Vao">Access Control Lists</a> (ACLs) and did not allow for delegation of subsets of a principal's authorization.  The encoding used was standard <a href="/facts/S-expression/TmCqHcln">S-expression</a>. Sample RSA public key in SPKI in "advanced transport format" (for actual transport the structure would be <a href="/facts/Base64/xIvVm33q">Base64</a>-encoded):
</p>
(public-key
   (rsa-pkcs1-md5
    (e #03#)
    (n
     |ANHCG85jXFGmicr3MGPj53FYYSY1aWAue6PKnpFErHhKMJa4HrK4WSKTO
     YTTlapRznnELD2D7lWd3Q8PD0lyi1NJpNzMkxQVHrrAnIQoczeOZuiz/yY
     VDzJ1DdiImixyb/Jyme3D0UiUXhd6VGAz0x0cgrKefKnmjy410Kro3uW1| )))

<p>The combined SPKI/SDSI allows the naming of principals, creation of named groups of principals and the delegation of rights or other attributes from one principal to another.  It includes a language for expression of authorization – a language that includes a definition of "intersection" of authorizations.  It also includes the notion of threshold subject – a construct granting authorizations (or delegations) only when <i>K</i> of <i>N</i> of the listed subjects concur (in a request for access or a delegation of rights).  SPKI/SDSI uses S-expression encoding, but specifies a binary form that is extremely easy to parse – an LR(0) grammar – called <a href="/facts/Canonical_S-expressions/J70ng5mL">Canonical S-expressions</a>.
</p><p>SPKI/SDSI does not define a role for a commercial <a href="/facts/Certificate_authority/WAo8vMTN">certificate authority</a> (CA).  In fact, one premise behind SPKI is that a commercial CA serves no useful purpose.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a>
As a result of that, SPKI/SDSI is deployed primarily in closed solutions and in demonstration projects of academic interest.  Another side-effect of this design element is that it is difficult to monetize SPKI/SDSI by itself.  It can be a component of some other product, but there is no business case for developing SPKI/SDSI tools and services except as part of some other product.
</p><p>The most prominent general deployments of SPKI/SDSI are E-speak, a middleware product from <a href="/facts/Hewlett-Packard/abuNSYNu">HP</a> that used SPKI/SDSI for access control of web methods, and <a href="/facts/UPnP/nrUmlpGr">UPnP</a> Security, that uses an XML dialect of SPKI/SDSI for access control of web methods, delegation of rights among network participants, etc.
</p>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/SPKAC/U7CcK4LP">SPKAC</a></li></ul>
<h2 id="notes">Notes</h2>

<h2 id="external-links">External links</h2>
<ul><li><a href="http://world.std.com/~cme/html/spki.html">SPKI homepage</a>,</li>
<li><a href="http://jsdsi.sf.net">JSDSI (open source development effort)</a></li>
<li><a href="http://sourceforge.net/projects/cdsa">CDSA (open source development effort)</a>.</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"SDSI – A Simple Distributed Security Infrastructure". people.csail.mit.edu. Retrieved 2017-03-15. <a href="https://people.csail.mit.edu/rivest/sdsi10.html" target="_blank">https://people.csail.mit.edu/rivest/sdsi10.html</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>Ellison, Carl (1996). "Establishing Identity Without Certification Authorities". 6th USENIX Security Symposium. CiteSeerX 10.1.1.31.7263. <a href="/wiki/CiteSeerX_(identifier)" target="_blank">/wiki/CiteSeerX_(identifier)</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
</ol>

Simple public-key infrastructure open-in-new

Simple public-key infrastructure