• Choose a category
• All
• Classic-Fiction

Under no circumstances should you ever divulge or send your private key. Doing so jeopardizes your guarantee that only you are able to work with the data and may irreparably damage your security.

Using Key Escrow

A key escrow system stores keys for the purpose of law enforcement access. If a criminal investigation is under way, law enforcement agents with a search warrant have the right to access and search records within the scope of the warrant. In general, the key archival system will provide the access needed. Key escrow is listed separately because the usage is important to a law enforcement investigation.

Key escrow refers to both a process and an organization or system that stores keys for access at a later date.

One of the proposed methods of dealing with key escrow involves the storage of key information with a third party, referred to as a key escrow agency. This agency would provide key information only when ordered by a court. In general, key escrow is handled by the key archival system.

In an early encryption system offered by the NSA for civilian use, the NSA would have acted as the key escrow agency. The system was called Clipper, and it wasn’t widely accepted by industry. The key escrow controversy was one of the chief reasons cited for its lack of acceptance.

Key escrow systems can also be a part of the key recovery process. Several government agencies are attempting to implement regulations requiring mandated key escrow. Mandated key escrow would allow law enforcement agencies to investigate a key escrow user without their knowledge. Many individuals and organizations view this as an invasion of their privacy, and they’re fighting the use of mandated key escrow on the basis that it violates personal freedom. The key escrow process is covered in more detail in the section “Recovering and Archiving Keys” later in this chapter.

The FBI and other national agencies are rumored to use keystroke logging software—often delivered as a Trojan Horse—for bypassing encryption. One of the most well known of these programs is Magic Lantern.

Identifying Key Expiration

A key expiration date identifies when a key is no longer valid. Normally, a key is date stamped; this means that it becomes unusable after a specified date. A new key or certificate is normally issued before the expiration date.

Keys with expiration dates work similarly to credit cards that expire. Usually, the card issuer sends another card to the cardholder before the expiration date.

Most applications that are key enabled or certificate enabled check the expiration date on a key and report to the user if the key has expired. PKI gives the user the opportunity to accept and use the key.

Revoking Keys

Keys are revoked when they are compromised, the authentication process has malfunctioned, people are transferred, or other security risks occur. Revoking a key keeps it from being misused. A revoked key must be assumed to be invalid or possibly compromised.

The credit card analogy is applicable here too. Consider a credit card that was stolen from a customer. This card, for all intents and purposes, is a certificate. A retailer could take its chances and accept the card, or it could verify that the card is accurate by running the card through a card verification machine to check its status. If the card has been reported stolen, the credit card authorization process will decline the charge.

Systems such as PKI use a CRL to perform a check on the status of revoked keys. Revocations are permanent. Once a certificate is revoked, it can’t be used again; a new key must be generated and issued.

Suspending Keys

A key suspension is a temporary situation. If an employee were to take a leave of absence, the employee’s key could be suspended until they came back to work. This temporary suspension would ensure that the key wouldn’t be usable during their absence. A suspension might also occur if a high number of failed authentications or other unusual activities were