Private Key Protection
Cryptographic Module Standards and Control
CA Private Keys must be used and unlocked on cryptographic modules that meet or exceed the requirements as defined in §6.2.11. The cryptographic modules are held in secure facilities.
CA Private Key Multi-Person Control
A minimum of two-person control will be established on the activation of any CA Private Key, and may be implemented as a combination of technical and procedural controls. Persons involved in management and use of the CA Private Keys shall be Trusted Roles.
Private Key Escrow
CA Private Keys are not escrowed.
Private Key Backup
All copies of the CA's Private Key shall be protected in the same manner as the original.
Private Key Archival
CA Private Keys are not archived.
Private Key Transfer into or from Cryptographic Module
CA Private Keys shall be generated by and secured in a cryptographic module. Private Keys are backed up and restored to multiple HSMs to provide high availability and disaster recovery, while remaining secured within the boundary of the cryptographic module.
Private Key Storage on Cryptographic Module
CA Private Keys are stored and secured on a cryptographic module as defined in §6.2.11.
Method of Activating Private Keys
CA Private Keys are activated upon generation and available for automated signing of revocation data and RA-initiated certificate signing.
Private Key Deactivation Methods
CA Private Keys will be deactivated upon termination of service.
Private Signature Key Destruction Method
No stipulation.
Cryptographic Module Rating
CA Key Pairs are generated and protected on a cryptographic module that is compliant to at least FIPS 140-2 Level 3 certification standards.