Directory authority operation and formats
Every authority has two keys used in this protocol:
KP_auth_id_rsa
: a long-term RSA authority identity key.
This key SHOULD be at least 2048 bits long;
it MUST NOT be shorter than 1024 bits.
KP_auth_sign_rsa
: a medium-term RSA authority signing key.
This key SHOULD be at least 2048 bits long;
it MUST NOT be shorter than 1024 bits.
The identity key KP_auth_id_rsa
is used from time to time
to sign new key certificates
containing (and authenticating) new KP_auth_sign_rsa
signing keys;
it is very sensitive.
It may be kept offline.
The signing key KP_auth_sign_rsa
is used to sign consensuses, votes,
and similar documents.
(Authorities also have a router identity key KP_relayid_rsa
,
and other keys used in their role as a router, and by earlier versions of the
directory protocol.)