A best practice for root CA Key update in PKI

Abstract

User authentication, data integrity and non-repudiation services using public-key infrastructure(PKI) are based on the assumption of the trust toward the root CA key in its domain. This root CA key which is commonly encoded as a self-signed certificate has a validity period and it must be updated before the expiration date of it. To do so, an appropriate root CA key update procedure must be proceeded. This paper explains the requirements and a concrete procedure for a root CA key update and the related security issues. Also we will provide an effective root CA key update mechanism considering a security and efficiency, which can be a best practice for handling the root CA certificate expiration. © Springer-Verlag Berlin Heidelberg 2004.