Considerations

Key Management Considerations

The Key Management issue can be complex and the sub sections of this document are here only as an guideline to the deeper issues. In selecting the best approach for your environment, the Digi-CAST™ Team can advise you and their advice will always be to keep things as simple as you can.

For Disposable Digi-IDs™, the Digi-CA™ will require Key Management enabled in advance because after five years, with only 100,000 end users, there will actually be 500,000 Key-Pairs in circulation. If you decide that you must use Disposable Digi-IDs™ then you should consider the following questions, for example:

• Given that your environment will experience at least one PC upgrade every three to five years, will you choose to move 3, 5, or more of the Key-Pairs from the old PC to the new one (and how will you do it)?
• More importantly, how will you have managed the backup and storage of all these Keys over the years?
• Also, does the Certificate Policy permit Private Key backup and multiple Key-Pair storage?
• When an employee leaves the organization and has several encrypted emails from three years back, how will they be decrypted?
• And will you have a copy of that particular Private Key from three years ago?

The solution to these problems is to have Key Management and Key Escrow services enabled in the Digi-CA™ during configuration and installation.

In the case of Renewable Digi-IDs™, you don’t really need Key Management and in many Trust Centre environments, Key Eskrow services are not permitted by law. Also, as the end user has only one Digi-ID™ or Key-Pair to take care of, it is a much easier task to provide assistance and enable them to ‘self recover’ from their own Backup.

• Key Management & Key Eskrow Recommendations<?li>
  Unless you have a strong case for using Disposable Digi-IDs™ and the required Key Management, there can be no logical reason for insisting on its implementation from a time, management or cost perspective. It is only important to know that the option is available to you, should you need it.

  Key Eskrow is a definite requirement for Disposable Digi-IDs™ but you may well decide it is not needed at all should you choose the alternative Renewable Digi-IDs™.