Public Key Infrastructure (PKI)

The trust anchor of the entire infrastructure. A CA is a trusted entity that issues, manages, and revokes X.509 digital certificates. It cryptographically signs a certificate to vouch for the binding between a public key and an entity's identity. In an AI audit context, a private enterprise CA issues certificates to models, inference endpoints, and logging services, ensuring every signed audit entry can be traced to a specific, authenticated component.

• Root CA: Offline, air-gapped, and highly secured; its private key compromise collapses all trust.
• Issuing CA: Online subordinate that handles day-to-day certificate issuance based on the Root CA's delegation.

The gatekeeper for identity verification. The RA acts as an intermediary between end-entities and the CA, performing the critical function of authenticating the identity of the subject requesting a certificate before the CA issues it. For AI governance, the RA validates the provenance of a model artifact or the identity of a data scientist requesting a code-signing certificate.

• Validates organizational attributes and domain control.
• Does not issue or sign certificates itself; it vouches for the request's legitimacy to the CA.

The distribution and revocation infrastructure. A Certificate Repository is a publicly accessible directory (often LDAP or HTTP-based) storing issued certificates. The Certificate Revocation List (CRL) is a time-stamped, CA-signed list of serial numbers of certificates that have been revoked before their expiration date. For immutable audit trails, an OCSP responder or CRL must be checked to ensure the signing key of an AI inference event hasn't been compromised.

• OCSP (Online Certificate Status Protocol): Provides real-time revocation status, avoiding the latency of downloading full CRLs.
• CRL Distribution Points (CDPs): URLs embedded in certificates pointing to the revocation list.

The core identity document. An X.509 v3 certificate is a structured, digitally signed data file that binds a public key to a subject's distinguished name. It includes critical metadata for audit integrity:

• Serial Number: Unique identifier for the certificate, logged in every audit entry for traceability.
• Validity Period: 'Not Before' and 'Not After' dates defining the operational lifespan.
• Key Usage/Extended Key Usage: Constraints limiting the certificate's purpose (e.g., digitalSignature, codeSigning), preventing a TLS certificate from being misused to sign an audit log.
• Subject Alternative Name (SAN): Allows binding identities like email addresses or DNS names.

The secure lifecycle of cryptographic material. Private keys must never exist in plaintext outside a Hardware Security Module (HSM). HSMs are FIPS 140-2 Level 3 certified devices that generate, store, and use keys within a tamper-resistant boundary. For AI audit trail immutability, the signing key for log entries is generated and stored exclusively in an HSM, providing the highest level of non-repudiation.

• Key Ceremony: A rigorous, multi-person, audited process for initializing and backing up Root CA keys.
• Key Escrow: Secure archival of private keys for recovery, critical for decrypting historical audit logs if the original key is lost.

The governance and legal framework. The Certificate Policy (CP) is a high-level document outlining the rules and requirements for certificate issuance and management within a specific community. The Certification Practice Statement (CPS) is the detailed operational document describing how a CA implements those policies. For AI governance, the CP/CPS defines the assurance level for identity verification, binding the technical PKI to legal enforceability.

• Defines liability, audit frequency, and subscriber obligations.
• Maps to Levels of Assurance (LoA) like NIST SP 800-63, specifying the rigor of identity proofing.