McAfee MEJCAE-AM-DA Product Guide - Page 25

Creating and Exchanging Keys What if I forget my passphrase or lose my key? Protecting your keys Besides making backup copies of your keys, you should be especially careful about where you store your private key. Even though your private key is protected by a passphrase that only you should know, it is possible that someone could discover your passphrase and then use your private key to decipher your email or forge your digital signature. For instance, somebody could look over your shoulder and watch the keystrokes you enter or intercept them on the network. To prevent anyone who might happen to intercept your passphrase from being able to use your private key, you should store your private key only on your own computer. If your computer is attached to a network, you should also make sure that your files are not automatically included in a system-wide backup where others might gain access to your private key. Given the ease with which computers are accessible over networks, if you are working with extremely sensitive information, you may want to keep your private key on a floppy disk, which you can insert like an old-fashioned key whenever you want to read or sign private information. As another security precaution, consider assigning a different name to your private keyring file and then storing it somewhere other than in the default E-Business Server folder where it will not be so easy to locate. However, be aware that you need to let E-Business Server know where it is. What if I forget my passphrase or lose my key? If you lose your key or forget your passphrase and do not have a backed up copy from which to restore your key, you will never again be able to decrypt any information encrypted to your key. You can, however, reconstruct your key if you implement a key restoration policy, where your key is encrypted and stored on a key reconstruction server. What is key reconstruction? Note: You cannot reconstruct a key that was generated on a smart card because the private portion of the key pair is non-exportable. You can set up a key reconstruction server to act as sort of a safety-net for you if you lose your private key or passphrase. The reconstruction server stores your key in such a way that only you can access it. Your company does not have the ability to decrypt your key. You need to provide recovery information-five questions and five secret answers-and send your key to the key reconstruction server. Once your key is on the server, you can restore it at anytime. To learn how to reconstruct your key, see Reconstructing your key on page 42. To send your key to your company's key reconstruction server: 1 Enter the following at the command line: ebs --reconstruct-data Where is the ID belonging to the key you want to store on the key reconstruction server. For example: ebs --reconstruct-data [email protected] 2 When asked for a prompt, enter a question that only you can answer. Choose an obscure personal question with an answer that you are not likely to forget. Your question can be up to 95 characters in length. An example of a good question might be, "Who took me to the beach?" or "Why did Fred leave?" An example of a bad question would be, "What is my mother's maiden name?" or "Where did I go to high school?" Note: If you prefer, you can also leave the prompts blank and simply provide answers. 23 E-Business Server™ 8.6 Product Guide