McAfee MEJCAE-AM-DA Product Guide - Page 43
Implementing your Additional Decryption Keys, Deleting your key from a key server
View all McAfee MEJCAE-AM-DA manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 43 highlights
Managing Keys Deleting your key from a key server To prevent unauthorized additional decryption and problems with liability, your organization should enforce a policy that the key should be split and shared by two or more individuals. Consider employee turnover and ensure that ADK's are properly rejoined and re-split as necessary to retain the ADK's integrity. Caution: Do not use ADKs unless you can ensure their security. In an environment that enforces use of an ADK, security of these keys determines the security of all encrypted messages in your entire organization. Implementing your Additional Decryption Keys To implement ADKs in your environment, you must first create the ADK(s). Note: If you want separate keys for the incoming ADK and the outgoing ADK, your key generation process must explicitly specify a different ADK key (incoming) than the one specified in the configuration file (outgoing). 1 Do one of the following: • Set the incoming/outgoing ADK by specifying the ADK-KEY parameter in the configuration file, and then generate a key (the --key-gen option) that meets your needs in terms of key type and key size. or • Enter the following on the command line to specify an incoming ADK: ebs --key-gen --adk-key 2 If you want to enforce use of the ADK, set the ENFORCE-ADK parameter to ON. For more information on setting the ADK-KEY configuration parameter, see ADK-KEY on page 87. For more information on setting the ENFORCE-ADK configuration parameter, see ENFORCE-ADK on page 94. Deleting your key from a key server You can remove your key from a key server so that it is no longer available to others. To remove your key from a server, you use the --keyserver-delete option. In order to delete a key from a key server, you need to specify a signing key to digitally sign the deletion request. Depending on the key server, you may also need a signing key to set up a secure TLS connection between the client and the server. By default, E-Business Server uses the key specified by the DEFAULT-KEY parameter in the E-Business Server configuration file (see DEFAULT-KEY on page 93). If you do not want to use the default signing key, then you can specify the signing key by adding the --sign-with modifier on the command line. Additionally, you can specify the passphrase for your signing key by including the --passphrase modifier. To delete your key from a key server: 1 Enter the following command at the command line: ebs --keyserver-delete [--keyserver ] For example: ebs --keyserver-delete "John Lee" E-Business Server displays the key information and prompts you for confirmation on the deletion. 2 Enter y to delete the key. 3 Enter the passphrase for your secret key. E-Business Server includes your signature in a request that it sends to the key server to delete the key. If you are not authorized by the key server to delete the specified key or if you can't delete keys from the machine you are using, then an error message appears. 41 E-Business Server™ 8.6 Product Guide