Netscape Certificate Management System 6.1, Руководство администратора

Страница: 199 / 840

199
Chapter 6
Data Recovery Manager
When data is stored in encrypted form, you must have the private key that
corresponds to the public key that was used to encrypt the data in order to decrypt
and read it. If the private key is lost, the data cannot be retrieved. A private key can
be lost because of a hardware failure, for example, or because the key’s owner
forgets the password or loses the hardware token in which the key is stored.
Similarly, encrypted data cannot be retrieved if the owner of the key is unavailable
to supply it—for example, has left the organization that owns the data.
This chapter explains how to use the Data Recovery Manager to archive
end-entity’s encryption private keys and how to use the archived keys later, in
place of missing encryption keys, to recover encrypted data.
This chapter contains the following sections:
• Data Recovery Manager’s Key Pairs and Certificates
• PKI Setup for Key Archival and Recovery
• Key Archival Process
• Key Recovery Process
• Installing a Standalone Data Recovery Manager
• Configuring Key Archival and Recovery Process
PKI Setup for Key Archival and Recovery
To be able to archive end-entity’s’ encryption private keys and recover them later,
you need a PKI setup that includes the following elements: