PGP Use Cases The following section presents the set of use cases relevant to working within a PGP ecosystem of products. Registration of a new Managed User This use case covers the registration of an internal user, that is one managed by the enterprise and whose key should be actively managed and maintained by the key management system. Description / User Story Khaled works with his company-issued MacBook Pro laptop every day for email, web surfing and other activities. His company decides to begin securing their email with PGP keys. Khaled’s company’s IT staff sends out directions to Khaled about how to download and install software on to his laptop to meet this requirement. Khaled follows the IT staff’s instructions, downloading the software and installing it. Upon first running the software, he is prompted to enter his company credentials. The software, in conjunction with the KMIP server, verifies those credentials and then issues Khaled a PGP key. That key is escrowed on the server and the private portion is held on the client as well. Khaled almost never manages this key directly; he just realizes his email is now being secured at certain times by various notifications he gets as he uses his normal email program. Goal or Desired Outcome A key must be created for Khaled containing his proper credentials (email addresses, user names, photo, etc.). The key must be signed by the correct organization key. The key must be stored on both the server and the client, both public and private portions, such that they may be used by both server and client for encryption and signing. Environment Categories Covered: Desktop-based enrollment Applicable Deployment and Service Models: On premises Actors: Khaled – a normal knowledge worker with little to no cryptographic experience Client Software – software designed to integrate with laptop / desktop endpoints and provide security for email messages Systems: Client Software Management Server – a server that administrators use to establish the security policy for the Client Software. (This server could be, and often is, the same as the KMIP server below.) KMIP Server – a server managing the key material for an enterprise Directory server – Active Directory or another
Arbitrary Key Signing Description / User Story Goal or Desired Outcome Environment Process Flow Decipher a Data Encryption Key Description / User Story Fahima works with Khaled on sensitive projects. During the course of their work, they share documents to which they occasionally allow other people access. These documents are encrypted to a key managed by a server. Fahima and Khaled are given access to the key by virtue of their credentials and permissions established in the key management system. Software on Fahima’s system mediates access to the encrypted document such that the encryption is largely transparent to her. Goal or Desired Outcome Fahima can create documents to share with a group of colleagues that are encrypted only to that group. Fahima doesn’t have to worry about the technical details behind that encryption. Administrators of the key management system can set up shared group keys with proper permissions. The key management system must unlock files for Fahima upon her properly identifying herself. Environment Categories Covered: Desktop-based enrollment Applicable Deployment and Service Models: On premises Actors: Fahima – a reasonably sophisticated encryption user Khaled – a normal knowledge worker with little to no cryptographic experience Client Software – software designed to integrate with laptop / desktop endpoints and provide Systems: Client Software Management Server – a server that administrators use to establish the security policy for the Client Software. (This server could be, and often is, the same as the KMIP server below.) KMIP Server – a server managing the key material for an enterprise Directory server – Active Directory or another