PKI安全的关键:CA的私钥保护

文章指出了PKI(PublicKeyInfrastructure)安全的关键是CA(CertificateAuthority)的私钥保护。由于ECC(EllipticCurveCryptography)比RSA等其他公钥密码系统能够提供更好的加密强度、更快的执行速度和更小的密钥长度,因此本文提出了一种基于椭圆曲线密码体制的组零知识证明方法和入侵容忍技术有机结合的私钥合成算法,通过影子服务器的影子安全地保护了私钥、无信息泄露地验证了私钥,而且在受攻击后仍能继续工作。通过可复原性和抗合谋性两方面的安全性分析得此策略有地解决了CA私钥的安全保护问题。

The Linchpin upon PKI Security: Protecting Private Key of CA

This paper points out that linchpin upon PKI (Public Key Infrastructure) security is the protecting private key of CA (Certificate Authority). It is shown that ECC (Elliptic Curve Cryptography) can provide greater strength, higher speed and smaller keys than other systems, therefore putting forward the arithmetic of synthesized private key, which is based on the or- ganic combination between the group zero- knowledge proof of the ECC and the intrusion tolerance technology. Through the share of the share servers, the private key can be protected safely, and validated without leaking information, further more the system can work sequentially after it is attacked. And also reveals that this tactic effectively solves the problem of protect- ing safely the CA private key to depend on analysis of the secu- rity from resilience and withstanding conspiracy attack.