Public Key Infrastructure (PKI)

Public Key Infrastructure (PKI) is the framework of hardware, software, policies, and procedures used to create, manage, distribute, and revoke digital certificates and cryptographic key pairs that enable authentication, digital signatures, and encrypted communication in federal government information systems.

What is PKI?

Federal PKI (FPKI) is the government's overarching PKI governance structure, managed by GSA, that enables trust across federal agencies and between agencies and their external partners. Within DoD, the DoD PKI is managed by DISA and provides the cryptographic backbone for CAC-based authentication and secure communications. PKI operates on asymmetric cryptography: each user or system has a key pair consisting of a public key (shared openly) and a private key (kept secret on the smart card or device). A Certificate Authority (CA) issues a digital certificate binding the user's identity to their public key. When a user authenticates to a system, they prove possession of the private key corresponding to the certificate, without ever exposing the private key itself. PKI certificates are used in federal environments for network authentication, email encryption and signing, document signing, and code signing. For contractors, PKI certificates on PIV or CAC cards are the mechanism by which they authenticate to government systems, and any IT systems they build for federal agencies must integrate with the agency's PKI for user authentication. Systems that use password-only authentication for federal users are generally non-compliant with federal identity management requirements.

Why PKI matters for government contractors

For IT contractors, proper PKI integration is a technical design requirement for virtually all federal system development work. Authentication systems must support PIV/CAC-based authentication, and contractors must understand certificate lifecycle management to build compliant, maintainable federal IT systems. Failure to implement PKI correctly is a common cause of security assessment findings during ATO review.

Example

An IT firm developing a case management system for a civilian agency designs the authentication layer to accept PIV card certificate-based authentication using the agency's FPKI-trusted certificates. During the security assessment, the assessor verifies that the system properly validates certificate chains, checks revocation status via OCSP or CRL, and enforces role-based access tied to PIV identity attributes, all standard PKI implementation requirements for federal systems.

Frequently Asked Questions

What is the Federal PKI (FPKI)?

The Federal PKI is the overarching trust framework managed by GSA that governs how federal agencies issue and recognize digital certificates. It establishes the hierarchy of Certificate Authorities trusted across the federal government and enables cross-agency PKI interoperability.

What is a certificate revocation list (CRL)?

A CRL is a list published by a Certificate Authority of all certificates that have been revoked before their natural expiration, typically because the private key was compromised, the card was lost, or the user's employment ended. Systems that verify identity must check the CRL (or use Online Certificate Status Protocol, OCSP) to ensure the presented certificate is still valid.

Can contractors use commercial PKI certificates for federal systems?

In limited contexts, some federal systems accept commercially issued PKI certificates for external partners. However, access to sensitive federal systems typically requires FPKI-trusted certificates or government-issued credentials (PIV/CAC). The acceptable certificate policies are specified in the system's security requirements.

What is an identity federation in the PKI context?

Identity federation allows PKI certificates from one organization or agency to be recognized by another, eliminating the need for duplicate enrollment. FPKI's cross-certification model is a form of PKI federation that allows federal agencies to trust each other's credentials without separate enrollment processes.