一种安全高效的入侵容忍CA方案

A Secure and High Efficient Intrusion Tolerance CA Scheme

CA是PKI中的关键设施。CA的私钥一旦泄漏,该CA签发的所有证书就只能全部作废;因此,保护在线CA私钥的安全是非常重要的。将CA的私钥以门限密码技术分享在n个部件中,不仅保证了CA私钥的机密性和可用性,同时使CA具备了入侵容忍性。所提出的CA方案,私钥以Shamir的拉格朗日多项式方式分享,更适合实际需求,实验表明具有良好的性能。

CA(certificate authority) is a critical component in PKI. When the private key of a CA is compromised, all the certificates issued by that CA should be revoked. Keeping the private key secret while providing service online is very important for a CA. Distributing private key of CA into n components via threshold cryptography can not only make the private key of CA secret and usability, but also make CA can tolerate some intrusion. A CA scheme and its private key distribute with Shamir's Lagarange polynomial secret shares, suit needs more practically. At last, security, efficiency and usability of the CA scheme are analyzed security. Through analysis, the scheme has good performance.