Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Administration Manual page 198

Chapter 7. Data Recovery Manager
Figure 7.1, "How the Key Archival Process Works"
when an end entity requests a certificate.
Figure 7.1. How the Key Archival Process Works
1. The client requests and generates a dual key pair.
a. The end entity, using a client which can generate dual key pairs, submits a request through
the Certificate Manager enrollment form.
b. The client detects the JavaScript in the enrollment form and exports only the private
encryption key, not the private signing key.
c. The Certificate Manager detects the key archival option in the request and asks the client for
the private encryption key.
d. The client encrypts the private encryption key with the public key from the DRM's transport
certificate embedded in the enrollment form.
2. After approving the certificate request and issuing the certificate, the Certificate Manager sends it
to the DRM for storage, along with the public key). The Certificate Manager waits for verification
from the DRM that the private key has been received and stored and that it corresponds to the
public encryption key.
3. The DRM decrypts it with the private key. After confirming that the private encryption key
corresponds to the public encryption key, the DRM encrypts it again with its public key pair of the
storage key before storing it in its internal database.
4. Once the private encryption key has been successfully stored, the DRM uses the private key of its
transport key pair to sign a token confirming that the key has been successfully stored; the DRM
then sends the token to the Certificate Manager.
5. The Certificate Manager issues two certificates for the signing and encryption key pairs and
returns them to the end entity.
176
illustrates how the key archival process occurs