Re: Online Certificate Revocation Protocol

[Marc Branchaud <marcnarc@xxxxxxxxxxxxxxx>]

Santosh Chokhani wrote:
> 
> Destroying a private key used to generate signature may cause some
> operational grief in terms of getting a new key certified, but there is no
> need for that key any more and hence no revocation is needed.
> 

Except that "destruction" is not necessarily irrecoverable.  I would always
revoke, as a general rule, especially for highly sensitive (e.g. CA) keys.

		Marc