Ideal within organizations where multiple CAs are needed and where one root CA must control all other CAs. Key and certificate management Refers to generating keys for encryption and signing, storing the keys in certificates, and administering keys securely and transparently, so that they are provided to users where and when they are needed. Included in key and certificate management is key update. Keys should have limited lifetimes and be updated regularly in a secure, transparent manner. Key backup and recovery Key backup is the process of maintaining the user's decryption keys.
Key recovery is the process of restoring the decryption keys.
The collection of decryption private keys belonging to a user. The length of time a key is valid. All keys have a specific lifetime except the decryption private key, which never expires. An organization needs a policy regarding key lifetimes. This policy should consider when keys will no longer be needed as well as the risks and threats of private key disclosure due to brute force attacks.