Service Modules : Public Key Cryptography : Digi-Sign.com

This section of the Guide provides general information on the functional concepts for each Digi-CA™Service Module. More detailed information as well as usage instructions for these modules are available in the following associated documents:

• Digi-CA™Administrator Guide
• Digi-CA™RA Operation Guide

The Cryptographic Service Provider [CSP] Service Module is a software application that ultimately provides the most of cryptographic operations to the system and is effectively responsible for generating all public key certificates. Due to the high severity for the security of this module, it is not accessible through any network communications protocol. This design imposes an asynchronous certificate generation and distribution model.

The only allowed control mechanism for this software module is manual, through the use of Operating System console command line interface [CLI]. CLI control options are limited to start, stop, key activation and general module configuration operations.

CSP in the overview of the CA core services acts as the Certificate Generation Service.

From an Operating System perspective, CSP is executed as a software daemon being also a client to the CA database server and Content Distributing Service. It sustains a persistent connection to the database from where cryptographic operation requests are loaded and subsequently served. The following table presents a general overview of the cryptographic functionality the CSP module is designed to provide.

Certified (digitally signed by the CA private key) public key certificates are instantly stored in a CA database and where immediate certificate dissemination is required, a Content Distributing Service is optionally called through an Uniform Resource Identifier [URI], further resulting in a certificate being distributed to the End Entity and, if necessary, published in a certificate LDAP directory.

CSP makes regular use of CA private keys and associated public key certificates and therefore it must have uninterrupted access to these keys at all times. Private keys used by CAs to certify public key certificates are by nature security sensitive. A CA must therefore provide sufficient security mechanisms and procedures to protect the CA private key from an illegitimate use by others.

CSP is designed to meet the highest security demands and simultaneously support two different types of Security Modules for secure private key access and storage:

• Software Security Module [SSM]
• Hardware Security Module [HSM]

The SSM is a CSP’s built-in cryptographic hardware-less feature. SSM uses PKCS#8 (Public Key Cryptography Standard) format to store private keys on a local file system in an encrypted manner. Private key encryption is accomplished by the use of encryption algorithm sets as defined in PKCS#5 standard.

Access to private keys in SSM is protected by a key activation password, which is used by the CSP to derive a "secret" further used to effectively encrypt CA private key information. Although a System Administrator or Security Officer may be aware of the SSM activation password, direct access to raw private key information is not likely possible, unless a successful attempt is made to reverse engineer the CSP source code in order to establish the precise secret derivation algorithms in use.

Once an instance of a CSP is launched, all private keys residing in the SSM private key repository configured for activation are loaded and remain in computer RAM memory until the CSP process is purposefully or unexpectedly terminated. Upon successful shutdown of the CSP process, the RAM memory area designated for private key storage is programmatically zeroed.

The SSM option for CA private key storage is designed to provide a cost-effective way of CA private key storage for small organisations, that intend to deploy Digi-CA™only for private use and where corporate security policies are actively maintained and followed by IT personnel and finally where the organisation has full control of the use of public key certificates.

Where greater CA private key protection mechanisms are a security demand, SSM option is strongly NOT recommended and this is where CSP offers a simultaneous use of hardware based cryptographic devices - HSMs - for secure private key storage and access.

HSMs introduce a very high level for private key protection and provide enhanced performance for cryptographic operations with the use of private keys, for example in the process of creating digital signatures.

There are two general types of HSM devices: host-attached and network-attached. The CSP supports both types of HSMs. A host-attached HSM device can be a device connected directly to a host server through a PCI, USB or SCSI interface. A network-attached HSM is a device connected to the host server over network using a Network Interface Card [NIC] attached to the server. Both types of HSM devices provide enhanced private key protection and meet the highest security criteria demand such as certification to FIPS 140-2 level 4 and/or Common Criteria EAL4+.

CSP communicates with the HSM device using a software library API, provided by the device vendor. When using HSM devices, private keys are physically stored and protected inside a hardware device and are never accessible as plain text. In fact, CSP has no real control over private keys stored on an HSM device as it merely makes the use of the hardware device layer to perform cryptographic operations.

HSM devices are therefore strongly recommended typically everywhere, where organisations intend to provide CA services to the public community or where the use of public key certificates is outside of the organisation’s exclusive control.

The table below presents example HSM models, that have been successfully tested with the CSP Service Module.