1

enter image description here

If they do keep our private key and by chance if anyone within the CA organization listen to our conversation. Isn't it a confidentiality breakage?

0

2 Answers 2

6

This is a bad model. The proper way to request a certificate is to send a CSR (certificate signing request) to the certificate authority

The CSR contains your public key only (it is signed using your private key to prove that you own the private key, and to ensure integrity of the request contents).

You should not use a mechanism where the CA generates the private key for you, it is not needed and only adds more ways for your private key to leak.

Final note: as usual, context matters a lot: if the scenario involves certificate issuance within an organization (eg: internal CA for corporate infrastructure) it might be acceptable, especially if the organization has a good process in place for key management. If possible show the source of the slide, it might make more sense in context.

1
  • 2
    For an example of how this can go wrong: Trustico was storing private keys clients had generated online, and were amazingly lax about securing them, leading to 23,000 certificates having to be revoked with minimal notice. (Trustico is apparently still in business. I don't know why; I'd never trust them for anything after that.) Sep 11, 2020 at 22:29
0

Isn't it a confidentiality breakage?

It depends how you define confidentiality. If you mean that nobody except the private key owner is authorized to know the private key, than yes it is a confidentiality breakage. But in some organizations there can be a policy that allows also some other persons (e.g. system administrators) to know user passwords or to have a copy of their private key. Means such persons are authorized to know this information. Thus this would not be a breakage. Breakage is the case when persons are unauthorized.

The picture in your question contains a misleading text "Example (Good)". In some cases like described above it can be fine. But in others, e.g. if user needs a certificate for private goals, such scheme is not good, but disastrous.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .