3 ms·
What is the threat model that results in this being your requirement?
by NovemberWhiskey 4y ago
What is the threat model that results in this being your requirement?
- lizardactivist 4y agoThere is no threat model, just curiosity, but obviously if the signing device is online then its signing key could potentially be retrieved by an attacker on the Internet.
- NovemberWhiskey 4y agoThe CA/B baseline requirements include storage of the private key on a FIPS 140 Level 3 cryptographic device (i.e. an HSM) so there's a certain minimum degree of assurance there.