Share via

3.1.1.2 ClientWrap Subprotocol

  • Article

ClientWrap key pairs: The server maintains a possibly empty set of RSA key pairs, each identified by a unique identifier. The public key of each pair is used for client-side secret wrapping, while the private key is used for the unwrap operation. The set of ClientWrap key pairs is held in persisted storage and survives system restarts. The server is assumed to have a method of looking up key pairs from this set based on the identifier. This state is shared with the LSA (Domain Policy) Remote Protocol server on the same machine, as explained in section 3.1.4.1.3 and 3.1.4.1.4.

Current ClientWrap key pair identifier: At any point in time, exactly one key pair from the set of ClientWrap key pairs is designated as the current ClientWrap key pair, and its identifier is stored as the current ClientWrap key pair identifier. If the set of ClientWrap key pairs is empty, then this identifier is empty as well. This identifier is held in persisted storage and survives system restarts.