Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 202 / 874

Key Archival Process
202 Netscape Certificate Management System Administrator’s Guide • June 2003
The client detects the JavaScript option and exports only the end-entity’s
encryption private key, not the signing private key.
The Registration Manager detects the key archival option in the end-entity’s
request and asks the client for the end-entity’s encryption private key.
The client encrypts the end-entity’s encryption private key with the public key
from the Data Recovery Manager’s transport certificate; a copy of the transport
certificate is embedded in the enrollment form.
2.
Upon receiving the encrypted key from the client, the Registration Manager
sends it to the Data Recovery Manager for storage, along with some other
information (including the end-entity’s public key). Then, the Registration
Manager waits for verification from the Data Recovery Manager that the
private key has been received and stored and that it corresponds to the
end-entity’s public encryption key.
3.
Upon receiving the encrypted key from the Registration Manager, the Data
Recovery Manager decrypts it with the private key that corresponds to the
public key in its transport certificate. After confirming that the private
encryption key corresponds to the end-entity’s public encryption key, the Data
Recovery Manager encrypts it again with its storage key before storing it in its
internal database. (The storage key either resides in a software or a hardware
token and is never exposed to any other entity.)
4.
Once the end-entity’s private encryption key has been successfully stored, the
Data Recovery Manager uses the private key of its transport key pair to sign a
token confirming that the key has been successfully stored; the Data Recovery
Manager then sends the token to the Registration Manager.
5.
After the Registration Manager receives and verifies the signed token, it sends
the certificate request to the Certificate Manager for issuance.
6.
The Certificate Manager formulates two certificates, one each for signing and
encryption key pairs, and returns them to the Registration Manager.
7.
The Registration Manager forwards the certificates to the client (the end
entity).
Note that all three subsystems subject the request to configured policy rules at
appropriate stages. If the request fails to meet any of the policy rules, the
subsystem rejects the request.