4. Key and certificate security and support

Users wishing to securely access servers on an open network, or to sign documents or mail, must have a certificate and the private key associated with it. While the certificate can be distributed to anyone, the private key must be well protected from third-party access.

Often, certificates and private keys are stored on the PC workstation in an encrypted file, access to which is protected by a password. The level of security obtained in this way is unsatisfactory, because once the password has been entered by the user to unlock the file, the private key appears unencrypted in real memory and is therefore liable to be revealed; moreover, we have already said how little protection a password offers.