文章指出了PKI(Public Key Infrastructure)安全的關(guān)鍵是CA(Certificate Authority)的私鑰保護。由于ECC（EllipticCurve Cryptography）比RSA 等其他公鑰密碼系統(tǒng)能夠提供更好的加密強度、更快的執(zhí)行速度和更小的密鑰長度，因此本文提出了一種基于橢圓曲線密碼體制的組零知識證明方法和入侵容忍技術(shù)有機結(jié)合的私鑰合成算法，通過影子服務(wù)器的影子安全地保護了私鑰、無信息泄露地驗證了私鑰，而且在受攻擊后仍能繼續(xù)工作。通過可復(fù)原性和抗合謀性兩方面的安全性分析得此策略有地解決了CA 私鑰的安全保護問題。
關(guān)鍵詞 CA；私鑰；入侵容忍；橢圓曲線密碼體制（ECC）；組零知識證明
Abstract: This paper points out that linchpin upon PKI (Public Key Infrastructure) security is the protecting private key of CA (Certificate Authority). It is shown that ECC (Elliptic Curve Cryptography) can provide greater strength, higher speed and smaller keys than other systems, therefore putting forward the arithmetic of synthesized private key, which is based on the organic combination between the group zero-knowledge proof of the ECC and the intrusion tolerance technology. Through the share of the share servers, the private key can be
protected safely, and validated without leaking information, further more the system can work sequentially after it is attacked. And also reveals that this tactic effectively solves the problem of protecting safely the CA private key to depend on analysis of the security from resilience and withstanding conspiracy attack.
Keywords: CA; private key; intrusion tolerance; Elliptic Curve Cryptography (ECC); Group zero-knowledge
proof