Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 33 / 554

Data Recovery Manager
11
1.2.3. Data Recovery Manager
The Data Recovery Manager (DRM) is an optional subsystem that acts as a Key Recovery Authority.
When configured in conjunction with a Certificate Manager, the DRM stores private encryption keys as
part of the certificate enrollment process. Private encryption keys archived in a DRM are recovered in
a PKCS #12 file only after multiple key recovery agents approve the recovery request.
NOTE
The DRM archives encryption keys. It does not archive signing keys, since archiving
signing keys undermines the non-repudiation properties of signing keys.
1.2.3.1. Key Archival
If a DRM is set up as part of the PKI, the private encryption key for an end entity is requested and
stored when the enrollment request is made.
1.2.3.2. Key Retrieval
If a DRM is set up as part of the PKI, the users' private encryption keys can be retrieved to decrypt
messages or other documents that have been encrypted with the private encryption key.
Version 7.1 of Red Hat Certificate System introduced a new
m-of-n,
ACL-based recovery scheme to
replace the old
m-of-n,
secret-splitting-based recovery scheme.
In the old scheme, the password for the storage token was split and protected by individual recovery
agent passwords. This made it hard to access the storage private, but it did not allow CS to fully
leverage the key protection facility provided by the underlying hardware token.
In the new scheme, CS uses its existing access control scheme to ensure recovery agents are
appropiately authenticated via SSL, and ensures that the agent belongs to the specific recovery agent
group. The recovery request is executed only when
m-of-n
recovery agents have granted authorization
to the request.
By default, the DRM sets up a 1-of-1 ACL-based recovery scheme, and the agent must belong to the
group "Data Recovery Manager Agents". You can change the scheme by modifying the appropriate
parameters in the
CS.cfg
file. Refer to
Chapter 7, Data Recovery Manager
for more information on
this topic.
1.2.4. Online Certificate Status Manager
The Online Certificate Status Manager is an optional subsystem that acts as an OCSP service.
Although the Certificate Manager is configured with an internal OCSP service, an external OCSP
responder is offered as a separate subsystem to provide OCSP service outside a firewall while the
Certificate Manager resides inside a firewall or to balance the load of requests on the Certificate
Manager.
The Online Certificate Status Manager performs the task of an online certificate validation authority by
enabling OCSP-compliant clients to verify certificate status. (An online certificate-validation authority
is often referred to as an OCSP responder.) The Online Certificate Status Manager can also receive
CRLs from multiple Certificate Managers, and clients can query the Online Certificate Status Manager
for the revocation status of certificates issued by all the Certificate Managers.