es. It permits the creation of legally verifiable identification objects, and it also dictates an encryption technique to protect data transmitted over the Internet. Usually, PKI involves client software, server software such as a CA, hardware (e.g., smart cards), and operational procedures. Using his or her private key, one user digitally signs a message, and the receiver, using the public key contained in the sender's certificate, issued by a CA within the PKI, can check that signature. In this fashion, two or more users can establish confidentiality, message integrity, and user authentication without having to exchange any special information in advance. PKI systems used in the enterprise are generally closely linked to the enterprise directory system, where each employee's public key is often stored, Chapter 9 IP Services along with his or her general contact information. The leading directory technol- ogy is LDAP, which is discussed in Chapter 10. Standards are absolutely vital to proper PKI operation, given that there is a cer- tificate hierarchy composed of at least several computers and often more than one organization, using interoperating software from different sources. The group responsible for developing standards in this area is the IETF PKIX working group (www.imc.org/ietf-pkix). This group's purpose is to develop the Internet standards needed to support an X.509-based PKI. (X.509 is discussed in the next section.) Overall, the market for commercial PKI operations has not bloomed as its pio- neers imagined. Too many differences in enacted laws and regulations, not to men- tion technical and operational problems, have slowed progress tremendously. PKI Alternatives There are some alternatives to PKI, including Web of Trust, Simple Public Key Infrastruc- ture, and Robot Certificate Authorities. The Web of Trust scheme makes use of self-signed certificates and a third party that attests to those certificates. Two examples of the Web of Trust are GNU Privacy Guard (GPG) and PGP, which has been extensive