Failures of public key infrastructure: 53 year survey
Adrian-Tudor Dumitrescu, Johan Pouwelse
TL;DR
The paper surveys long-standing failures and risks of Public Key Infrastructure (PKI) in the context of national digital identities, outlining technical, economic, legal, and social factors that hamper large-scale deployment. It traces a historical shift from centralized PKI trust in Certificate Authorities toward decentralized approaches (SDSI, TOFU, IRMA, Sovrin) that aim to improve privacy and user control, while introducing governance and scalability trade-offs. Through case studies of India, Canada, Germany, Estonia, Peru, and Italy, it highlights how national identity initiatives grapple with privacy, data governance, adoption, and interoperability within or beside PKI frameworks. The work emphasizes careful, GDPR-aligned, user-centered design and governance to realize secure, verifiable digital identities without creating surveillance risks, underscoring that substantial benefits (e.g., potential GDP gains) hinge on avoiding repeated mistakes.
Abstract
The Public Key Infrastructure existed in critical infrastructure systems since the expansion of the World Wide Web, but to this day its limitations have not been completely solved. With the rise of government-driven digital identity in Europe, it is more important than ever to understand how PKI can be an efficient frame for eID and to learn from mistakes encountered by other countries in such critical systems. This survey aims to analyze the literature on the problems and risks that PKI exhibits, establish a brief timeline of its evolution in the last decades and study how it was implemented in digital identity projects.