| (I) An optional PKI entity (separate from the CAs) that does not
sign either digital certificates or CRLs but has responsibility
for recording or verifying some or all of the information
(particularly the identities of subjects) needed by a CA to issue
certificates and CRLs and to perform other certificate management
functions. (See: organizational registration authority,
registration.)
(C) Sometimes, a CA may perform all certificate management
functions for all end users for which the CA signs certificates.
Other times, such as in a large or geographically dispersed
community, it may be necessary or desirable to offload secondary
CA functions and delegate them to an assistant, while the CA
retains the primary functions (signing certificates and CRLs). The
tasks that are delegated to an RA by a CA may include personal
authentication, name assignment, token distribution, revocation
reporting, key generation, and archiving. An RA is an optional PKI
component, separate from the CA, that is assigned secondary
functions. The duties assigned to RAs vary from case to case but
may include the following:
- Verifying a subject's identity, i.e., performing personal
authentication functions.
- Assigning a name to a subject. (See: distinguished name.)
- Verifying that a subject is entitled to have the attributes
requested for a certificate.
- Verifying that a subject possesses the private key that matches
the public key requested for a certificate.
- Performing functions beyond mere registration, such as
generating key pairs, distributing tokens, and handling
revocation reports. (Such functions may be assigned to a PKI
element that is separate from both the CA and the RA.)
(I) PKIX usage: An optional PKI component, separate from the
CA(s). The functions that the RA performs will vary from case to
case but may include identity authentication and name assignment,
key generation and archiving of key pairs, token distribution, and
revocation reporting. [R2510]
(O) SET usage: "An independent third-party organization that
processes payment card applications for multiple payment card
brands and forwards applications to the appropriate financial
institutions." [SET2]
|
