The core GSI software provided by the Globus Toolkit expects the user's private key to be stored in a file in the local computer's storage. To use the GSI, the user must enter the pass phrase required to decrypt the file containing their private key. This allows users to store their private key on a smartcard rather than in a filesystem, making it still more difficult for others to gain access to the key. The new certificate contains the owner's identity, modified slightly to indicate that it is a proxy. The certificate also includes a time notation after which the proxy should no longer be accepted by others.
Proxies have limited lifetimes.
The proxy's private key must be kept secure, but because the proxy isn't valid for very long, it doesn't have to kept quite as secure as the owner's private key. It is thus possible to store the proxy's private key in a local storage system without being encrypted, as long as the permissions on the file prevent anyone else from looking at them easily. Once a proxy is created and stored, the user can use the proxy certificate and private key for mutual authentication without entering a password. When proxies are used, the mutual authentication process differs slightly. The CA's public key is then used to validate the signature on the owner's certificate.