PKI

PKI is how the web solves the introduction problem: you have never met the server, so you trust a third party that vouches for it. Your browser ships with a list of a few hundred such authorities, and any one of them can vouch for any name. Bitcoin was designed to avoid needing that list at all.

How it works

PKI has three components, and only one of them lives on your device.

A certificate authority owns a signing key and issues certificates after checking something about the applicant, which for ordinary web certificates means confirming control of a domain name and nothing further. A certificate binds a name to a public key and carries the authority's signature over both. A trust store, shipped with your operating system or browser and updated alongside it, lists the authorities you accept, and everything else follows from that list.

The weakness in the model is structural rather than accidental. Trust is not scoped: an authority in any country can issue for any domain in the world, so the security of every site equals the security of the weakest authority in the store. That is not hypothetical. Attackers who compromised the Dutch authority DigiNotar in 2011 issued a fraudulent certificate for Google's domain and used it against internet users in Iran, browser vendors pulled DigiNotar's roots, and the company was bankrupt by September of that year. Google announced in 2017 that Chrome would stop trusting the Symantec certificate business after saying more than 30,000 certificates had been issued improperly.

Two mitigations followed. Certificate Transparency, specified in RFC 6962 in June 2013, requires certificates to be published in public append-only logs so that misissuance is at least detectable when it cannot be prevented. Certificate lifetimes were also cut hard, on the theory that a short-lived credential limits the damage done by one that should never have existed.

Where you see it

PKI protects the moment you type an exchange password, which is its main role in a bitcoin buyer's life.

It is also where the limits bite. A padlock means the connection is encrypted and the domain matches a certificate. It does not mean the business is honest, licensed, or solvent, and a lookalike domain registered by a scammer gets a valid certificate in seconds precisely because it does control that domain. Read the spelling of the name in the address bar, and reach the site through a bookmark rather than an advertisement.

Hardware wallet vendors run their own small infrastructure for device attestation, with a single root they control instead of a public store. That arrangement is far stronger than the web's for the plain reason that it contains no third parties.

Bitcoin's own design took the other road entirely. An address is derived from a key by hashing, so there is no name to certify and nobody to ask. You verify a destination by comparing characters, which is worse for usability and removes several hundred trusted parties from the picture.

PKI vs public key

PKI is not the general term for using public keys. Generating a key pair, receiving bitcoin at the address derived from it, and later signing a transaction with it involves no authority, no certificate and no trust store, which is the entire point of the design. PKI is the specific bureaucracy built to attach real-world names to keys, and bitcoin deliberately does without it.