Risks of PKI: Secure E-Mail

Written by C. Ellison and B. Schneier

Public-key infrastructure (PKI), usually meaning digital certificates from a commercial or corporate certificate authority (CA), is touted as the current cure-all for security problems.

Certificates provide an attractive business model. They cost almost nothing to manufacture, and you can dream of selling one a year to everyone on the Internet. Given that much potential income for CAs, we now see many commercial CAs, producing literature, press briefings and lobbying. But, what good are certificates? In particular, are they any good for E-mail? What about free certificates, as with PGP?

Hadist (1)

Rasulullah saw. bersabda, “Siapa saja yang mati tanpa berjihad dan tidak terdorong hatinya (hasratnya) untuk berjihad (berjuang) maka dia mati dalam keadaan munafik. (HR Muslim, Abu Dawud, an-Nasai, dan Ahmad).