一种在线CA安全增强方案  

Security Enhancement Scheme of Online CA

作　　者：谭玉玲[1] 王新林[1] 

机构地区：[1]广东罗定职业技术学院,罗定527200

出　　处：《重庆科技学院学报（自然科学版）》2009年第5期127-129,共3页Journal of Chongqing University of Science and Technology：Natural Sciences Edition

基　　金：广东省科技攻关基金资助项目（082400440260）

摘　　要：CA私钥的安全性决定了签发证书的有效性。基于ECC（椭圆曲线算法）和（t，n）门限密码技术，结合先应秘密共享机制，提出了一种容侵的CA私钥保护方案。方案通过（t，n）秘密共享机制把CA私钥分发给t个服务器，并通过先应秘密共享体制进行私钥份额动态更新，结合可验证的秘密共享（VSS）方案，实现了CA私钥的容侵保护。最后，通过Java和Openssl对系统进行了实现。Protecting the CA private key is the key issue of the whole PKI. An intrusion tolerant protection scheme of CA private key was proposed basing on the ECC and （t,n） secret shared method and proactive secret share. The scheme ensure that the private key never be reunion at any time. At the same time, in the proceeding of CA generated, delivered and used, even if some part of the CA is broken, the CA private key is still safe. Thus, it ensures the validity of the digital certificate delivered by the online CA. At last, the system was realized by Java and Openssl.

关 键 词：CA私钥 椭圆曲线算法 容侵 门限密码学 先应秘密共享 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]