This explains a lot about how certificate authorities store their private keys. I read somewhere else that the key is broken down into as much as 20-something parts, and stitched together from those 20-something people holding their part. Nothing is connected to the internet and it's in a vault.

What I imagine is that each person has a USB drive, and they plugin their USB drive to some chip/board in the vault, it runs some program to generate their 1/20th part of the key, and then this process repeats for each person until the whole key is constructed.

But I have read here that basically USB sticks are inherently insecure, that you should never use them (it sounds like), because they can all have malware on them and it gets automatically run when the USB is plugged into the computer. So I wonder if there are any USBs that don't have this problem. But the main question is, if not USBs, I'm wondering what the CA people do to combine their portions of the key, if they use some sort of specific USB (and if so, the type), or if there is some other more secure technology used.

  • 1
    why can't they type in a password? or swipe a magstripe? or scan a bar/qr code? You're also conflating a USB device issue with a USB mass storage device, but that's an aside... – dandavis Dec 5 '18 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.