![](bgc.png)
Also, as seen in the Section 4, the overall deploy-
ment of LOCALPKI can be made using only existing
tools, which facilitates the process.
As further work, legal aspect on the shared respon-
sibility of the LRA and the EN in LOCALPKI should
be studied, since both entities play an important role
into the registration and authentication processes. Our
first idea is that the EN could register the identity
of the LRA sending information about new users and
store this information also within the database. Thus,
if this user is recognized as malicious, the EN could
blame the LRA.
Further work also includes a study about adapt-
ing the secure trust computations described in (Dumas
et al., 2016). They compute a global trust by using
the trust evaluation of each certification authorities to-
wards the others. This allows to obtain a better hint
about the trust given in CAs, instead of being based
only on the trustfulness given by trust anchors. This
method could be relevant to the LOCALPKI architec-
ture, since it is also using the trust anchor mechanism.
We also plan to realize a study of whether this
model could also simplify identity-based approaches
like certificateless PKI (Gentry, 2003; Baek et al.,
2005).
Finally, just like Let’s Encrypt offers certificates
enabling HTTPS (via SSL/TLS) for websites, we plan
to set up a web site offering the possibility to create
self-signed LOCALPKI certificates for any user.
REFERENCES
Baek, J., Safavi-Naini, R., and Susilo, W. (2005). Certifi-
cateless public key encryption without pairing. In In-
formation Security, 8th International Conference, ISC
2005, Singapore, September 20-23, 2005, Proceed-
ings, volume 3650 of Lecture Notes in Computer Sci-
ence, pages 134–148. Springer.
Basin, D., Cremers, C., Kim, T. H.-J., Perrig, A., Sasse, R.,
and Szalachowski, P. (2014). ARPKI: Attack resilient
public-key infrastructure. In Proceedings of the ACM
Conference on Computer and Communications Secu-
rity (CCS), pages 382–393.
Bau, J. and Mitchell, J. C. (2010). A security evaluation of
DNSSEC with NSEC3. In Proceedings of the Network
and Distributed System Security Symposium, NDSS
2010, San Diego, California, USA, 28th February -
3rd March 2010. The Internet Society.
Bouzefrane, S., Garri, K., and Thoniel, P. (2011). A user-
centric PKI based-protocol to manage FC2 digital
identities. IJCSI International Journal of Computer
Science Issues, 8(1):74–80.
Comon-Lundh, H. and Cortier, V. (2004). Security proper-
ties: two agents are sufficient. Sci. Comput. Program.,
50(1-3):51–71.
Cooper, D. (2008). Internet X.509 Public Key Infrastruc-
ture Certificate and Certificate Revocation List (CRL)
Profile. RFC 5280.
Dolev, D. and Yao, A. C. (1981). On the security of pub-
lic key protocols. In Proceedings of the 22Nd An-
nual Symposium on Foundations of Computer Sci-
ence, SFCS ’81, pages 350–357, Washington, DC,
USA. IEEE Computer Society.
Dumas, J.-G., Lafourcade, P., Orfila, J.-B., and Puys, M.
(2016). Private multi-party matrix multiplication and
trust computations. In Proceedings of the 13th Inter-
national Joint Conference on e-Business and Telecom-
munications (ICETE 2016), pages 61–72.
Gentry, C. (2003). Certificate-based encryption and
the certificate revocation problem. In Proceedings
of the 22Nd International Conference on Theory
and Applications of Cryptographic Techniques, EU-
ROCRYPT’03, pages 272–293, Berlin, Heidelberg.
Springer-Verlag.
Kim, T. H.-J., Huang, L.-S., Perrig, A., Jackson, C., and
Gligor, V. (2013). Accountable key infrastructure
(aki): A proposal for a public-key validation infras-
tructure. In Proceedings of the 22Nd International
Conference on World Wide Web, WWW ’13, pages
679–690, New York, NY, USA. ACM.
Kolkman, O. M., Mekking, M., and Gieben, R. M. (2012).
DNSSEC Operational Practices, Version 2. RFC
6781.
Laurie, B., Langley, A., and Kasper, E. (2011). Certificate
authority transparency and auditability. white paper,
22.
Meier, S., Schmidt, B., Cremers, C., and Basin, D. A.
(2013). The TAMARIN prover for the symbolic anal-
ysis of security protocols. In Sharygina, N. and Veith,
H., editors, Computer Aided Verification - 25th In-
ternational Conference, CAV 2013, Saint Petersburg,
Russia, July 13-19, 2013. Proceedings, volume 8044
of Lecture Notes in Computer Science, pages 696–
701. Springer.
Mu
˜
noz, J. L., Esparza, O., Forn
´
e, J., and Pallares, E. (2008).
H-ocsp: A protocol to reduce the processing burden
in online certificate status validation. Electronic Com-
merce Research, 8(4):255.
Peylo, M. and Kause, T. (2012). Internet X.509 Public
Key Infrastructure – HTTP Transfer for the Certificate
Management Protocol (CMP). RFC 6712.
Reddy, R. and Wallace, C. (2010). Trust anchor manage-
ment requirements. RFC 6024, RFC Editor.
Ryan, M. D. (2014). Enhanced certificate transparency and
end-to-end encrypted mail. In 21st Annual Network
and Distributed System Security Symposium, NDSS
2014, San Diego, California, USA, February 23-26,
2014. The Internet Society.
Santesson, S., Ankney, R., Myers, M., Malpani, A.,
Galperin, S., and Adams, D. C. (2013). X.509 Inter-
net Public Key Infrastructure Online Certificate Status
Protocol - OCSP. RFC 6960.
Schmidt, B., Meier, S., Cremers, C. J. F., and Basin, D. A.
(2012). Automated analysis of diffie-hellman pro-
tocols and advanced security properties. In Chong,
SECRYPT 2017 - 14th International Conference on Security and Cryptography
198