...
- The metadata signing key
- A Key Authority Officer
- A Technical Authority Officer
- The metadata repository
The metadata signing key is the private key used to sign InCommon metadata. The public key corresponding to the private metadata signing key is bound to the metadata signing certificate, which is stored on a secure web server (ops.incommon.org). This key pair together form the basis of the trust fabric of the InCommon Federation.
The metadata signing key is a secure offline key. It is stored on the hard drive of an offline laptop, which is kept in a safe in a secure facility with limited strict physical access controls.
Access to the safe is further limited to a few individuals collectively referred to as the Key Authorityitself requires both a key and a pin. A Key Authority Officer provides the key while a Technical Authority Officer knows the pin. A single individual can not be both a Key Authority Officer and a Technical Authority Officer, that is, no one person knows the location of the key and the pin.
A software process that signs and publishes metadata is run daily. This process runs on an offline laptop kept in the safe. Only a handful of individuals can initiate the software process. Collectively these individuals are known as the Technical Authority.
...