MODULE - 4

Key Management
K e y m an ag em en t m e an s h and ling cry ptog raphic ke y s s afe ly — from t he m om e nt t he y a re c re at e d un til t he y

are de st roy e d.

K e y m an ag em en t is ab out ke eping e nc rypt ion k ey s sa fe an d und er c ont rol. W ith out it, e ve n s tron g

c ry pt og ra ph y b ec om es us e les s .

It’ s a ve ry im po rt ant part o f c y be rs e c urity be c aus e ev en if y ou us e t he s tron ge s t e nc ry pt ion, y ou r s y st e m

c an s t ill be broke n if th e k ey s are not m ana g ed prope rly .

Why It’ s Important

•C rypt o g ra ph y k e e ps d at a s a fe b y u s in g k e ys to lo c k (e n c rypt ) a n d u nlo c k (d e c rypt )
info rm a tio n.

•If t h e s e ke ys a re no t s t or e d, s ha re d , o r d e le t e d s e c u re ly, h a c k e rs c an s te a l t he m a n d
a c c e s s all yo u r d a ta .

•S o , e ve n if th e e n c ryptio n m e t ho d (like A ES o r R S A ) is s t ro ng , b a d k e y m a n a g e m e n t
m a ke s it u s e le s s .
10.1 Key management fundamentals

T his s ec t ion is an introd uc tio n to ke y m anag e m e nt . It e xpla ins w h at k ey m a nag e m e nt is a nd w hy it is im port ant .

It a lso introd uc es t he ke y life c yc le , w hic h s ho w s t he diffe ren t s t ag es of a k ey from c re at ion to d es t ruc tion . T h e

res t of th e c ha pt e r w ill us e th is life cy c le to explain ke y m anag e m e nt .

Im ag ine y ou ha ve a diary with a lock .

[Link] Creation: Y ou ge t a ne w ke y t o loc k y ou r d iary.

[Link] Storage: Y ou ke ep t he ke y s afe in a d ra w e r.
[Link] Use: Y ou u se t he ke y t o o pe n a nd c los e yo ur diary w he ne ve r y ou w ant .
[Link] Distribution: Y ou giv e a co py of t he ke y t o a t rus te d frie nd s o t he y c an re ad it t oo.
[Link] Destruction: W he n th e d iary is no long e r ne ed ed , y ou de st roy th e k ey s o no one c an ope n it .
T his is how c ry pto graphic ke y s are m anag e d in a sim ple w ay — c re atio n, st orag e , us e, s haring , an d de s truc t ion.
 10.1.1 What is key management?
K e y m an ag em en t is t he se c ure hand ling of cry ptog raphic ke y s. It’ s not jus t on e t hin g — it involv es m a ny

differe nt proc e s se s w o rk ing to ge t he r t o k ee p ke y s s afe .

C rypt og raphic ke ys are ju st s pe c ial da ta , s o m anag ing t he m invo lve s m any are as of info rm at ion s e cu rit y , lik e:

[Link] controls: U s ing spe c ial hardw are or prot oc ols t o s tore and sh are k ey s s afely .
[Link] controls: F ollow ing rule s, proc ed ures , an d plans to avoid los ing ke ys .
[Link] controls: C ons ide ring w h ere th e k ey s are st ore d phy sic ally an d t he en viro nm e nt th ey are
us e d in.

[Link] factors: P e ople h andle ke y s , a nd m is t ake s c an ha ppe n, s o c areful proc es s e s a re ne e de d.

E ve n t houg h ke ys are only a s m all part of an o rg an iza tion ’ s da ta, key management touches many security

areas like ph ys ic al s e cu rit y , ne tw ork s ec urit y , a cc e s s c on trol, and dis as te r rec ove ry .
A ls o, key management itself often uses cryptography t o ke e p k ey s s afe.
10.1.2 The key lifecycle
10.1.3 Fundamental key management requirements
T h er e a r e two main requirements t ha t a p ply t o a ll st a g e s o f k ey m a n a g em en t :

1. Secrecy of Keys
S ec re t k eys (l ik e sy m m e tr ic k eys a n d pr iva t e ke ys) m us t a lw a ys st a y se cre t a nd on l y b e k n ow n to au t h o riz ed p eo pl e or s yst em s.

T h ey ca n b e exp os ed i n m a n y w a ys , so t h ey m u s t be p ro t ect ed in e very p ha s e:

During creation: I f w ea k m e th o d s ar e us ed , a t ta c ke rs m a y g u es s th e k ey.

During transfer: W h e n k eys a re se n t, th ey c an b e s to l en — so us e s ec ur e tr a ns fe r m et h od s .
During storage: K e ys m u s t be s to re d sa f el y s o a tt a ck e rs ca n ’ t a cc ess t h em .
During destruction: K e ys m u st b e d el et ed p ro pe rly s o n o o ne c an rec o ver th e m l a te r.
I n sh o rt i f ke ys a re n o t ke pt s ecr et , encryption becomes useless.

2. Assurance of Purpose of Keys

P e o ple u si n g a k e y s h ou l d b e s u re w h a t th e k ey is f or a n d w h o i t be lo n g s t o. T hi s m ea n s k no w i ng :

W hi ch person or system t he k ey i s l in k ed t o .

W hi ch cryptographic algorithm i t’ s m ea n t fo r .

A n y usage limits, lik e “ t h is k ey is o n ly fo r si g n in g ” o r “ t h is k ey is o nl y fo r en cr yp ti on .”

I f t h e k ey’ s p u rpo s e i s un c lea r o r w ro n g , s eri o us s ecu r it y p ro b le m s ca n h a pp en — fo r exa m ple , u si ng a s ig n in g k ey fo r en c ryp ti o n.

10.1.4 Key management systems

A key management system is a ny s ys te m t ha t he lps t o m a na g e a ll t he pha s es o f t he key lifecycle — suc h a s c re a ti ng, st o ri ng,

s ha ring , us ing , a nd des tr o y ing cr yp to g r a phic k e ys .

U nlik e c ry pt o g ra p hic a lgo rit hm s (w hic h m us t fo l lo w st r ict s ta n da rds ), k e y m a na g em ent s ys te m s ca n vary depending on the

needs of an organization. E a ch o rg a niz a tio n des ig ns i ts s ys te m b a s e d o n ho w it w o r k s a nd w ha t it nee ds.

A k e y m a na ge m e nt sy st e m c a n dep e nd o n:

•Network topology: I t’ s e a si er if o nly t w o pe o pl e c o m m un ica t e se cur e ly tha n i n a la r ge c o m p a ny w i th t ho us a nds o f u se rs .

•Cryptographic mechanisms: T he sy st em m a y dif fe r fo r symmetric a nd public-key cr yp to gr a phy .
•Compliance requirements: S o m e la w s m a y r equir e k ey r ec o ver y o r b a ck up .
•Legacy systems: So m e o rg a niza tio ns m u st us e o l der sy s te m s to st a y co m pa t ib le w it h t heir p a rt ne rs .
B ec a us e o f t hes e fa c t o rs , e ve ry o rg a niz a t io n m us t ca r ef ully design and choose a k e y m a na ge m e nt sy st e m t ha t fit s it s ne e ds.

T he r e a r e a lso m a ny international standards tha t g ive guid a nce , b ut t hey a r e o ft en ver y det a ile d a nd ha r d t o f o llo w

c o m pl et el y. So , m o s t o r g a niza t io ns f o llo w t he main ideas (spirit) o f t he se st a nda r ds ra t her t ha n e ver y sing le r ule (let t er ).
10.2 Key lengths and lifetimes
K e y le n g t h m e a ns how big or long a key is, m e a s ure d in bit s .

•Longer keys = more secure, b e c a us e t he y a re ha rd e r fo r h ac k e rs to g u e s s or b re a k.

•B u t longer keys = slower performance — t h e y t a ke m o re tim e t o u s e an d ne e d m or e
s t ora g e s pa c e .

S o, th e re ’ s a balance be t w e e n security and efficiency.

W e c ho o s e a k e y t h at is “ long enough to be safe” , b ut not too long th a t it s lo w s

e v e ryth ing d o w n .

E xa m ple :

If a pas s w ord ha s 4 le tt e rs (like “ A B C D ” ), it ’ s e as y t o g u e s s .

If it h as 1 2 le t te rs a nd nu m b e rs (“ A b 1 C 9 xP 7 zR 3 L ” ), it’ s h ard e r to c ra c k — bu t

t ak e s lo n g e r to type a n d s to re .
 10.2.1 Key lifetimes
A key lifetime m ea ns ho w l o ng a se cr et k e y (use d f o r enc ry pt io n o r a ut he ntic a t io n) c a n b e us ed s a f ely b e fo r e it m us t b e

c ha nge d.

A f te r i ts lif e tim e ends , t he k ey expires a nd sho ul d b e replaced o r destroyed.

T he r e a r e m a ny re a s o ns w hy c ry pt o gr a p hic k ey s ha ve f ini te lif et im es . T hes e incl ude:

1. Mitigation against key compromise

➡ Why: If s o m eo ne m a na ge s to s t ea l o r g ue ss yo u r k e y, t hey c a n m is use it .

➡ So: U si ng k e ys f o r a sho r t t im e re duc es th is r is k .

2. Mitigation against key management failures

➡ Why: So m e t im e s p e o ple le a ve a n o r ga niz a t io n o r lo s e a cc es s co nt ro l .

➡ So: K ey s a re c ha nge d r eg ula rl y t o p re ve nt m is use .

3. Mitigation against future attacks
➡ Why: A s t e chno lo g y im p ro ve s , ha c k er s ca n b re a k o ld e nc ry pt io n f a s te r.

➡ So: K ey s a re m a de t o e xpir e before t he y b e co m e w e a k .

4. Enforcement of management cycles

➡ Why: K ey ex pir y ca n b e m a tc hed to b usine ss o r b ill ing cy cl es .

➡ So: It he lp s i n o rg a niz ed k ey r ene w a l a nd a c ce s s c o nt ro l.

5. Flexibility
➡ Why: D iff e re nt a pp lic a ti o ns m a y ne e d dif fe re nt lif et im es .

➡ So: Sho r t er lif et im es ca n use s m a lle r , c hea p er k e ys .

6. Limitation of key exposure

➡ Why: Eve ry t im e y o u use a k e y , t iny b it s o f inf o r m a t io n a b o ut it c o uld le a k .

➡ So: L im i ting ho w lo n g t he k ey is us ed r e duce s t he t o ta l exp o su re .

10.2.2 Choosing a key length
•Key length m e ans ho w s tron g yo ur se c re t c ode (ke y ) is.
→ Lon ge r ke y = h arde r t o bre ak.

•Key lifetime m e an s h ow lo ng yo u’ ll us e t ha t ke y be fore c ha ng ing it.

T he y are c on ne ct e d:

•If y ou u se a k ey for a long time, it sh ould be longer and stronger.

•If y ou u se it fo r a short time, a shorter key ca n w o rk .
In C rypt og ra ph y

•E xpe rt s (lik e N IS T o r E C R Y P T II) g ive ru les on w hic h k ey le ng t hs are s afe .

•For e xam ple :
• AES-128 bit → s e cu re for s hort t o m ed ium t im e .
• AES-256 bit → be t te r fo r lo ng -t erm s e c urity .
•O lde r o ne s lik e Triple DES a re no t ve ry st rong any m o re .
10.3 Key generation

Key generation m e a n s creating secret keys us e d for e n c rypt io n a n d d e c rypt io n .

It is t he first and most important step in ke e pin g d at a s a fe .

If k e ys ar e n o t m a de pro pe rly, h a c ke r s c a n e a s ily g u e s s t he m — e ve n if t h e e n c ryp tion m e th o d

is s t ro ng .

Types of Key Generation

[Link] Key
[Link] Key (Asymmetric)
10.3.1 Direct key generation
Symmetric keys a re b a s ica l ly random numbers or bit strings (a s er ies o f 0 s a nd
1 s ). S o , the ea sie st w a y t o m a k e a k e y i s t o generate a random number — o r

m o re c o m m o nly, a pseudorandom number (a num b e r t ha t r a nd o m b ut i s

cr ea t ed b y a co m p ute r p ro g r a m ).
10.4 Key establishment
Key establishment i s t he pr o c es s o f g et t ing cr yp to g r a phic k e ys t o t he r ig ht pla c es — b a sic a lly , m a k ing sur e tha t e ver yo ne (o r
e ver y devic e ) t ha t ne e ds a se cr et k e y ha s i t se cur el y.

T he s e k e y s a r e w h a t a l lo w en cr yp ti o n a nd de cr yp t io n t o ha p pe n — s o if k e ys a r e no t s a fe ly s ha re d, t he w ho le se cur it y s y st em

c a n fa i l.

Key establishment can be:

The key doesn’ t need to be shared.
Ex a m pl e: Y o u cr e a te a k e y o n yo ur o w n c o m p ut er t o enc ry p t y o ur o w n f ile s.

N o o ne e lse ne eds t ha t k ey → no ne e d to se nd it a ny w her e.

The key doesn’ t need to be secret.

Ex a m pl e: A — it ’ s m e a nt to b e s ha re d o p enl y.

So , “ e st a b lis hing ” it (g et ti ng i t t o o t he rs ) is n’ t re a lly a s ec ur ity is sue , jus t a lo g ist ic a l o ne .

The key is set up in a controlled environment.

Ex a m pl e: K ey s a re lo a de d int o de vic es (lik e S IM ca r ds o r T V b o xes ) b e fo re th ey a re g ive n to cus to m er s.

T hi s i s c a lle d key predistribution — t he k ey s a re a lr e a dy i n pl a ce w hen the de vice s le a ve t he fa ct o ry .

10.4.1 Key hierarchies
10.4.2 Unique key per transaction schemes
E ve ry t im e tw o d evic e s (like a pay m e nt te rm inal a nd a h os t c om put e r) co m m un ica te , th ey us e a

new, unique key for th at s pe cific tran sa ct ion.

T his inc rea se s s ec urit y — e ve n if one ke y is c om prom ise d, it only affec t s , no t

t he w ho le s y s te m .
 10.5 Key storage
K e y s to ra ge re fe rs t o h ow a nd w he re s e cre t cry pt og raphic ke y s a re ke pt w he n t he y ’ re not ac tiv ely be ing us e d.

B e c aus e t he se ke y s prot e ct s en sit ive dat a (lik e e nc ry pt e d files , m e ss ag e s , or trans ac t ions ), it’ s c rit ic al t hat

t he y d on’ t fall in to t he w ro ng han ds .

S o, t his se c tio n ta lks abo ut h ow to s t ore t he m s e cu re ly and w h at t o d o if a ke y is lo st or be c om e s unav ailable .

Why Key Storage is Important

T hink of a c ry pto g ra ph ic k ey like t he pa ss w ord t o all y our s e cre ts :

If s om eo ne st e als it → th ey c an re ad a ll yo ur en cry pte d d ata .

If y ou los e it → yo u c an’ t d ec ry pt y our ow n da ta a ny m ore .

S o, s ec ure ke y st orag e m us t prot e ct ag ain st bot h:

Un aut horize d ac c es s (ke e pin g a tt ac ke rs o ut)

Lo ss or c orruption (m akin g su re y ou c an st ill ac c es s y our ow n dat a)

10.5.1 Avoiding Key Storage
•B e s t w ay : don’ t store keys at all.
•Jus t create a key when needed a nd de le te it afte r us e .
•N o s t orag e = n o th eft ris k.

10.5.2 Key Storage in Software

K e y s are s av ed in files or apps.

T he y are u su ally encrypted an d pro te c te d b y pas s w o rd s.

E as y to u se , bu t hackers or viruses c an st e al t he m .

10.5.3 Key Storage in Hardware

K e y s are k ept in special devices (like c hips , s m a rt c ards , or H SM s).

T he ke y never leaves the de vic e .

M uc h safer tha n s oftw are st orag e .

10.5.4 Key Storage Risk Factors
K e ys c a n be los t o r s to le n if:

S om e o n e steals th e de vic e .

A hacker b re a ks in.

P e ople make mistakes o r u s e w e a k pro t e c tio n.

10.5.5 Key Backup, Archival, and Recovery

A lw a ys ke e p secure backups o f k e ys .

Archival = s to re old k e ys for o ld da t a.

Recovery = a s afe w a y t o g e t ke ys b a c k if los t.
10.6 Key usage
A f t er k eys a re created , shared , a n d stored, th e n ext s te p i n t he ir lifecycle i s h o w t h ey a re used. T hi s sec ti o n t al k s a b o u t h ow t o use keys

safely a n d manage them properly d ur in g th e ir li fet i m e.

1. Key Separation
K e ys sh o u ld b e u se d fo r (e .g ., o n e k e y f o r e n cry pt io n , a n o th er f o r a u t he n ti ca t io n ).

T h is li m i ts t he d a m a g e if a ke y is co m p ro m i sed .

E xa m p le: N eve r us e th e sa m e k ey f or b o t h d at a e n cry pt io n a n d d ig i t al s ig n a tu r es.

2. Key Change (Rotation)

K e ys sh o u ld b e ch a n g ed per io d ic al ly o r af t er ce rt ai n co n d it io n s (li k e s u spe ct ed c o m pr o m is e).

T h is re d uc es t he r isk expo s ur e w in d ow if a n a t ta c ke r g a in s ac ce ss t o a k ey .

3. Key Activation
A k ey sh o u ld h a ve a d ef in ed — it ’ s o nl y val id f o r us e af t er it ’ s f or m a ll y a c ti va te d.

B e fo re a ct i vat io n , i t m i g h t exis t in s t or a g e bu t n o t b e us ed .

4. Key Destruction
W he n a k ey i s n o l o ng er n eed e d , it m us t b e s ec ur el y d e let ed so i t ca n ’ t b e re co vere d (e .g ., t hr o ug h o verw r it in g o r h a rd w a r e d es t ru ct io n ).

P r even t s o ld k ey s fro m b ei ng e xp lo it e d.
10.7 Governing key management
K e y id e a: M an a g ing c r ypto g ra ph ic k e ys is n ot ju s t a bo u t t e c hn o lo g y— it ’ s a ls o a b ou t ru le s

a nd pro c e s s e s , e s pe c ia lly in o rg a n is a t io n s .

W h y K e y G o ve r na n c e M a tt e rs

K e ys a re u s e le s s if t he y’ re lo s t, s to le n, or m is u s e d.

G ov e rn an c e m a ke s s u re ke ys a re us e d c o rre c tly, s e c ur e ly, an d o n ly b y th e r ig ht pe ople .

E xa m ple : A c o m pa ny e n c rypt s c us t o m e r d a ta . If an yo n e c a n a c c e s s t he e n c rypt io n k e ys , th e

d at a is at ris k — e ve n if th e e n c ryptio n is s t ro ng .
10.7.1 Key management policies, practices and procedures
1. Policies – The Rules
•W h a t t h ey a re: H i g h -le vel ru le s o r st r at eg ies f o r k e y m a na g e m e nt .
•P u rp os e: Te ll t h e o r g a ni sa t io n w h a t m u st be d o n e.
•E xa m pl e: “ A ll e nc ry pt io n k ey s m u st b e st o red in s ecu r e h a rd w a re ( H S M s) .”
2. Practices – How to Follow the Rules
• W ha t t h ey a re : M e th o d s or a pp ro a ch es t o m e et t h e po li cie s.

• P u r po se : T el l s ta f f ho w to im p le m en t t h e po li cie s.

• E xa m p le: “ E ver y de vic e t h a t u ses en c ryp t io n m u s t ha ve a b u il t-i n H S M .”

3. Procedures – Step-by-Step Instructions

• W ha t t h ey a re : D e ta il ed s t eps t o ca r ry o ut t h e pr ac ti ce s.

• P u r po se : T el l s ta f f exa ct ly w h a t t o d o.

• E xa m p le: “ U s e a sp eci fi c k e y e st a bl is hm en t pr o to c ol w h en tw o de vic es exc ha n g e k ey s.”

Key Qualities of Good Key Management Governance

By design – P l a nn e d fr o m t h e be g in n in g , n ot i m p ro vis ed .

Coherent – A ll ph a se s of t h e ke y lif ec ycl e (cr ea ti o n , u se, ro ta t io n , d es t ru ct io n ) f it t o g e th er .

Integrated – W or k s s m o o th l y w i t h th e o rg a n is a ti o n’ s ove ra ll se cu ri t y a n d p rio r it ies .

10.7.2 Example procedure: key generation ceremony
Participants in a Key Generation Ceremony
1. Operation Manager
•M a n a g es ph y sic a l s et u p: ve n ue , h a rd w a re, so ft w a re , a n d m e di a .
•E n su re s a l l t o o ls a n d en vir on m en t s a r e r ea d y.

2. Key Manager
O ver see s t h e ce rem on y .

E n su re s it f ol lo w s a ll po l ici es , pr ac ti ce s, a n d pr o ced u re s.

3. Key Custodians
H o ld t h e ke y c o m po n en t s.

H a nd l e a n d t ra n sp o rt t h em sec u rel y.

4. Witnesses
O b ser ve an d r ec or d t he e nt ir e pro c ess .

E n su re a ll p ar t ici pa n ts a ct ac co rd i ng t o t he r ul es .
MODULE - 4
Public-Key Management
Public-Key Management
P ub lic -K e y M a n ag e m e n t is a ll ab o u t how we handle and protect public and private keys t h at a re

u s e d in public-key cryptography.

J us t lik e yo u n e e d to safely store, share, and update passwords, in c rypt o g ra ph y w e n e e d a

system t o h an d le keys pro pe rly — e s pe c ially pu b lic ke ys , s inc e t he y a re s ha re d ope nly bu t

m u s t s t ill b e t ru s te d .

Why It’ s Important

In pu b lic -k e y c r ypto g ra ph y, e v e ryo n e h a s :

A public key – s h are d w it h o t he rs .

A private key – k e pt s e c re t.

W e m us t m ak e s u re a public key really belongs to the right person.

T h at ’ s w ha t public-key management d o e s — it b uild s trust.

11.1 Certification of Public Keys
W hen w e us e pub li c-k ey c ry pt o g ra p hy, ev er yo ne ha s :

•A pub l ic k ey – s ha re d w it h o t her s
•A pr iva t e k ey – k e pt s ec re t
T he p ro b l em is:

H o w d o w e t r ust t ha t a pub l ic k ey r ea ll y b e lo ng s t o t he ri ght pe r so n?

The Solution: Public-Key Certificate

A p ub lic -k e y ce rt if ic a te is lik e a digit a l ID c a rd.

I t p r o ves t ha t a pub l ic k ey b e lo ngs t o a s pe ci fic p er so n o r o rg a niz a tio n .

I t i s g ive n b y a t rus te d a ut ho r ity c a lle d a C er ti fic a t e A ut ho r it y (C A ).

How It Works
Y o u a s k t he C A f o r a ce rt if ic a te .

T he C A che c k s y o ur ide ntit y .

T he C A cr ea te s a nd si gns a c er ti fic a t e w it h y o ur na m e + p ub lic k e y.

O t he rs c a n no w t rus t yo ur p ub lic k ey b y ch ec k ing the C A’ s s ign a tur e.

11.1.1 Motivation for public-key certificates
Why We Need Public-Key Certificates
P ub lic -k ey c er ti fic a t es a r e ne ede d t o m a k e s ure a public key really belongs to the person it says it does a nd tha t it is b e ing

us ed c o r re ct ly .

I m a gi ne t his s itu a tio n

B o b g et s a m e ss a ge t ha t sa y s it ’ s s ig ned b y A li ce .

T o che ck the s igna t ur e, B o b ne eds A lic e’ s p ub lic k e y.

H e g et s a k ey t ha t sa y s , “ T h is i s A l ice ’ s k ey ” — b ut :

❓ H o w c a n B o b b e s ure it r ea l ly b elo ng s to A lice ?

❓ W ha t if it’ s f ro m a n a t ta ck e r p r et endi ng t o b e A lic e?
I f B o b use s a fa k e k e y, t he s ig na tur e w ill s t ill “ l o o k co r r ec t,” a nd B o b m ight t hink A l ice s igne d it — w he n s he di dn’ t!

So luti o n

A p ub lic -k e y ce rt if ic a te , i ss ued b y a tr ust e d C e rt if ic a te A ut ho ri ty (C A) , s o lve s a l l t hes e pr o b lem s.

I t p r o ves :

T he k e y b elo ng s to the r ea l o w ner .

T he k e y is va lid a nd use d p ro p er ly .
11.1.2 Public-key certificates

A pub lic-k e y c ert ific a te is lik e a n ID c a rd fo r a pub lic k ey — it p ro v es w ho a

pu b lic k ey b e lo ng s to a nd t ha t it ca n b e t rus te d .

It usua lly incl ud es :

1 .N a m e o f o w ne r – w h o th e k e y b elo n g s t o (a p ers o n, d e vi ce, o r

o r g a niza t io n).

2 .P ub l ic k ey – t he a ctu a l k e y u sed fo r enc ryp tio n o r d ig it a l s ig na t ure s.

3 .V a lid i ty pe rio d – t he tim e d uri ng w hich the ce rt ific a te is va l id (st a rt a nd

ex p iry d a t es).

4 .D ig it a l s ig na t ure – c re a te d b y a t rus te d a ut ho r ity to co nfi rm t ha t t he

 PUBLIC-KEY CERTIFICATE CREATORS
A Certificate Authority (CA) is a t ru st e d org anizat ion t hat c rea te s and m anag e s public-key certificates .

It h as three main jobs:

[Link] creation:
T he C A c he c ks th at all th e in fo rm atio n (like t he ow n er’ s nam e an d public ke y ) is c orre ct , th en sig ns an d is su es

t he ce rtific at e.

[Link] revocation:
If a ce rtific at e b ec om es inv alid (for e xam ple , if t he priva te ke y is s t ole n or t he ow ne r le ave s a c om pan y), t he C A

c an c an ce l or revoke it .

[Link] trust anchor:

T he C A is t he main source of trust — e ve ry on e re lie s o n it to m ake s ure c e rtific ate s are re al a nd ac c urat e. T o

ke e p t his t ru st , th e C A m us t st ay s ec ure and w e ll-k now n.

11.2 The certificate lifecycle
T he public-key certificate lifecycle e xp la ins ho w a ce rti fica t e i s c re a te d , use d ,

m a na g e d , re new ed , a nd e ve ntu a lly ex pir ed o r r ev o k e d — jus t l ik e ho w k ey s h a ve

th eir o w n life cy cle , b ut w it h e xt ra st eps to ha nd l e trust and verification.

11.2.1 Differences in the certificate lifecycle

G e n e r at e k e y pa ir → ✅
V e rify id e n tity → C r e a te 📝
c e rt ific a te → ✍ C A s ig n s it → �� Is s ue to
o w ne r
Public-Key Management Models
T his part t alks ab out diffe re nt w ay s to m ana ge an d t ru st public ke y s.

It s t arts by look ing at how to trus t C ert ific at e A ut horit ie s (C A s) , e s pec ially ho w differe nt C A g roups ca n

c onn ec t or w ork t og e th er.

T he n, it looks at ho w s om e on e w ho u se s a c e rt ifica te (a re ly ing pa rt y ) int erac t s w it h a C A .

B a se d o n t his , it e xplains differe nt w ay s (m od els ) t o m a nag e pu blic ke ys an d c ert ific at e s.

11.3.2 Public-key certificate management models
CA-FREE CERTIFICATION MODEL
REPUTATION-BASED CERTIFICATION MODEL
CLOSED CERTIFICATION MODEL
CONNECTED CERTIFICATION MODEL