VE 07KeyMgmt: Difference between revisions

# Private keys and secret keys are stored in the private key database. At Security Level 1, the operating system is restricted to a single operator mode of operation, which protects against unauthorized disclosure, modification, and substitution of the private keys and secret keys stored in the private key database. At Security Level 2, we use the discretionary access control mechanism of the operating system on the private key database to protect against unauthorized disclosure, modification, and substitution of the private keys and secret keys stored in the private key database. <div class=note>The private keys and secret keys stored in the private key database are password-encrypted using DES-EDE3 (Triple DES) to provide additional protection against unauthorized disclosure, modification, and substitution. The password-based encryption is considered by FIPS as in plaintext form.</div> When the private keys and secret keys reside in memory, they are protected by the OS.

# Public keys are stored in two ways.

## X.509 v3 certificates containing public keys are stored DER encoded in the certificate database. The certificates are not encrypted, but are digitally signed by the Certification Authority (CA) that created them.