Public-Key Infrastructure

The system of certificates and authorities that lets parties trust which public key belongs to whom, enabling encryption and signatures at scale.

The Trust Problem

Public-key cryptography lets you encrypt to someone or verify their signature using their public key, but only if you are sure the key really belongs to them. An attacker who substitutes their own key can impersonate anyone. Public-key infrastructure (PKI) solves this binding problem: it is the framework of certificates, authorities, and policies that vouches for which public key belongs to which identity.

Certificates and Authorities

Kronos motion — which application

A certificate binds an identity to a public key
A certificate authority (CA) signs certificates, vouching for the binding
Anyone trusting the CA can trust the certificates it signs
Root CAs anchor chains of trust; intermediates extend them

The Chain of Trust

Trust flows in a chain: a system ships with a set of trusted root certificates; a root signs an intermediate; an intermediate signs an end-entity certificate. To verify a certificate, you follow the chain up to a trusted root. This lets a browser or device trust a server it has never seen, because it trusts the authority that vouched for it.

Revocation

Keys get compromised, so PKI must be able to revoke certificates before they expire. Mechanisms like certificate revocation lists and online status checks let verifiers reject a certificate that has been withdrawn. Revocation that is slow or ignored is a recurring weak point in real deployments.

Fusion Context

A fusion program uses PKI to authenticate services, secure remote access with mutual TLS, and anchor code-signing trust. For the Hyperion breeder and burner designs, an internal PKI can issue and revoke certificates for devices and operators, with private keys held in hardware security modules and a migration path to post-quantum algorithms given the plant's long service life.