Download OpenTrust root CA Certification Policy

6.2.4.3 CA
CA private signature keys shall be backed-up under the same multi-person control as the operational ones.
All back-up copy of the signature key shall be stored in the CA off-site location (refer to section 5.1.8 above)
and the number of back-up copy is controlled by trusted roles.
6.2.5
Private Key Archival
6.2.5.1 RCA
RCA private keys shall never be archived.
6.2.5.2 ICA
ICA private keys shall never be archived.
6.2.5.3 CA
Private keys shall never be archived.
6.2.6
Private Key Transfer Into or From a Cryptographic Module
6.2.6.1 RCA Private Key
In case of private key transfer, then the RCA key pair is transferred to another Hardware Security Module
(HSM) of the same specification as described in section 6.2.1 above, by direct token-to-token copy or via a
trusted transfer under N out of M multi-person control (Refer to section 6.2.2 above).
RCA keys are generated, activated and stored in HSMs or in an encrypted format. When they are not stored
onto HSMs, RCA private keys are encrypted. An encrypted RCA private key cannot be decrypted without
using an HSM with the required trusted role (activation data holder), and must be performed in the presence
of multiple persons in trusted roles.
6.2.6.2 ICA Private Key
In case of private key transfer, then the ICA key pair is transferred to another Hardware Security Module
(HSM) of the same specification as described in section 6.2.1 above, by direct token-to-token copy or via a
trusted transfer under N out of M multi-person control (Refer to section 6.2.2 above).
ICA keys are generated, activated and stored in HSMs or in an encrypted format. When they are not stored
onto HSMs, ICA private keys are encrypted. An encrypted ICA private key cannot be decrypted without using
an HSM with the required trusted role (activation data holder), and must be performed in the presence of
multiple persons in trusted roles.
6.2.6.3 CA Private Key
In case of private key transfer, then the ICA key pair is transferred to another Hardware Security Module
(HSM) of the same specification as described in section 6.2.1 above, by direct token-to-token copy or via a
trusted transfer under N out of M multi-person control (Refer to section 6.2.2 above).
Sub-CA keys are generated, activated and stored in HSMs or in an encrypted format. When they are not
stored onto HSMs, private keys are encrypted. An encrypted private key cannot be decrypted without using
an HSM with the required trusted role (activation data holder), and must be performed in the presence of
multiple persons in trusted roles.
© OpenTrust. All rights reserved.
Ref : OpenTrust_DMS_RCA Program_OpenTrust_CP v 1.2
- 69 -
www.opentrust.com