Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Руководство администратора

Страница: 187 / 840

187
Chapter 6
Data Recovery Manager
When data is stored in encrypted form, you must have the private key that corresponds to
the public key that was used to encrypt the data in order to decrypt and read it. If the private
key is lost, the data cannot be retrieved. A private key can be lost because of a hardware
failure, for example, or because the key’s owner forgets the password or loses the hardware
token in which the key is stored. Similarly, encrypted data cannot be retrieved if the owner
of the key is unavailable to supply it—for example, has left the organization that owns the
data.
This chapter explains how to use the Data Recovery Manager to archive end-entity’s
encryption private keys and how to use the archived keys later, in place of missing
encryption keys, to recover encrypted data.
This chapter contains the following sections:
• Data Recovery Manager’s Key Pairs and Certificates
• PKI Setup for Key Archival and Recovery
• Key Archival Process
• Key Recovery Process
• Installing a Standalone Data Recovery Manager
• Configuring Key Archival and Recovery Process
PKI Setup for Key Archival and Recovery
To be able to archive end-entity’s’ encryption private keys and recover them later, you need
a PKI setup that includes the following elements:
• Clients that can generate dual keys and that support the key archival option (using the
CRMF/CMMF protocol). These include versions 6.2 and 7.0 and higher.