Re: PKI Disaster Recovery and Key Rollover

[Andy Nourse <nourse@xxxxxxxxx>]

On 7/9/07 6:45 AM, "Denis Pinkas" <denis.pinkas@xxxxxxxx> wrote:

> 
> To the WG,
> 
> I edited together with Joel Kazin an individual Internet-Draft that has been
> placed on the IETF web server.
> The target category is INFORMATIONAL.
> 
> The document is now available at:
> https://datatracker.ietf.org/drafts/draft-pinkas-pkix-pki-dr-kr
> 
> The abstract is the following:
> 
>    This document presents a framework to assist the writers of policy
>    or practice statements and the designers of a Public Key
>    Infrastructure to prepare disaster recovery plans in case of a
>    private key-compromise or a private key-loss.  This may happen to
>    end-entity keys, Certification Authorities, Revocation Authorities,
>    Attribute Authorities, or Time-Stamping Authorities.  Since
>    certificates have finite validity, CA key-rollover should be
>    planned in advance.

Key rollover is included in the SCEP draft:
http://www.ietf.org/internet-drafts/draft-nourse-scep-15.txt
For CA certificates, we have the ability to retrieve the "next" certificate,
which is the certificate that will replace the current CA certificate when
it expires.  The SCEP response is signed by the current CA cert, as it is
intended that the "next" certificate be retrieved while the current one is
still valid.

Normally, CA key rollover would happen when the CA key expires, but it could
be done early in the event of key compromise or loss.


Andy Nourse
Cisco Systems