McAfee MEJCAE-AM-DA Product Guide - Page 42

Managing Keys Additional Decryption Keys Additional Decryption Keys Suppose your chief scientist is hit by a bus and is hospitalized for months. Or that your lead engineer, in a rage, encrypts his entire hard drive and leaves the company. What happens to all that data, which is so securely encrypted? Can you retrieve it, or is it gone forever? An Additional Decryption Key (ADK) is a data recovery tool. In an environment that enforces use of an ADK, any information encrypted to a user's key is also encrypted to the Additional Decryption Key. When someone inside or outside the organization encrypts information to a user, the information is also encrypted to the Additional Decryption Key. This allows the owner of the Additional Decryption Key to decrypt any information sent to the user. This process happens automatically and is fully integrated into the encryption process. Recover data in an emergency An ADK is a powerful security tool in situations where an employee is injured, incapacitated, or terminated, leaving valuable information encrypted. Because E-Business Server has no "back door," recovery of this information would be otherwise infeasible. While you may not ordinarily use your ADKs, there may be circumstances when it is necessary to recover someone's data, for example, if someone is out of work for some time or if you are subpoenaed by a law enforcement agency and must decrypt messages or files for a court case. Data recovery versus key recovery Do not confuse data recovery with key recovery. An Additional Decryption Key lets you recover information that has been encrypted to a particular key, not the key itself. The difference is crucial. If a mechanism exists to obtain a copy of a user's key, one major feature of a public-key cryptosystem-non-repudiation-is lost. If more than one copy of a key exists, then a user can deny having signed information with the key. Retaining copies of users' keys has an added security risk: the machine storing the keys is an obvious target for attack, as is the administrator of the machine. An Additional Decryption Key is far easier to protect, and it enables you to retain non-repudiation, which is a major advantage inherent to public-key cryptography. Types of ADKs E-Business Server offers two types of ADKs: Incoming ADKS, and Outgoing ADKs. • An incoming ADK is used by E-Business Server during key generation. An incoming ADK's key ID is associated with new keys during key generation, and henceforth when someone attempts to encrypt to the new key, E-Business Server also attempts to encrypt to the ADK. Incoming ADKs may be either Diffie-Hellman/DSS or RSA keys. You cannot use an RSA Legacy key as an incoming ADK. • An outgoing ADK is associated with an installation of E-Business Server. Outgoing ADKs are automatically added to users' keyrings and are always part of a recipient list. Outgoing ADKs can be of any key type. Additional Decryption Key policy Your Security Officer must decide whether your company enforces the use of ADKs. You should have a policy that governs how and when they will be used and should communicate this policy to everyone who will be affected by it. This policy should consider employee privacy as well as the security of the ADK against attack and accidental loss. Protecting your Additional Decryption Key Additional Decryption Keys must be secured both physically and electronically in order to prevent a security breach. If either the incoming or outgoing ADK is ever compromised, all encrypted messages sent to users with additional decryption enabled could be decrypted by the attacker. E-Business Server™ 8.6 Product Guide 40