PorKI: Making User PKI Safe on Machines of Heterogeneous Trustworthiness

As evidenced by the proliferation of phishing attacks and keystroke loggers, we know that human beings are not wellequipped to make trust decisions about when to use their passwords or other personal credentials. Public key cryptography can reduce this risk of attack, because authentication using PKI is designed to not give away sensitive data. However, using private keys on standard platforms exposes the user to “keyjacking”; mobile users wishing to use keypairs on an unfamiliar and potentially untrusted workstation face even more obstacles. In this paper we present the design and prototype of PorKI, a software application for mobile devices that offers an alternative solution to the portable key problem. Through the use of temporary keypairs, proxy certificates, and wireless protocols, PorKI enables a user to employ her PKI credentials on any Bluetoothenabled workstation, including those not part of her organization’s network, and even those that might be malicious. Moreover,...

• Type: Conference
• Year: 2005
• Where: ACSAC
• Authors: Sara Sinclair, Sean W. Smith
• Keywords: ACSAC 2005, Proxy Certificates, Security Privacy, Temporary Keypair, Untrusted Workstation Face