Procedure for an EDCS Participant if His Cryptographic Keys are Compromised

The Procedure for an EDCS Participant if His Cryptographic Keys are Compromised

1. Once his cryptographic keys have been compromised, an EDCS Participant must notify the EDCS Organizer’s Security Administrator that the closed (secret) keys have been compromised by calling 745–81-42 and stop using those keys for exchanging information with other EDCS Participants.
2. Within one business day, the EDCS Participant must send a written notice of the compromise, signed by the head of the organization and certified with the organization’s seal, to the EDCS Organizer’s Security Administrator.
3. If the EDCS Participant has backup cryptographic keys and the effective keys are kept separately from the backup ones, making their simultaneous compromise impossible, he may continue working using the backup keys. In the absence of backup cryptographic keys, the EDCS Participant must create new closed (secret) keys and the application for an electronic signature key certificate. To generate new cryptographic keys, the EDCS Participant must use the registration key.
4. The application for an electronic signature key certificate generated when creating new cryptographic keys must be sent by e-mail to pki@micex.com.
5. The EDCS Participant must pay for the EDCS Organizer’s services in accordance with the fees and the payment procedure (see Payment for Services section).
6. Include the EDCS Participant’s certificate generated by the EDCS Organizer in the local certificate reference guide at the client workstation using the Certificate Reference Guide and make the certificate accessible.
7. Sign, seal, and return to the EDCS Organizer’s Security Administrator one copy of the electronic signature key certificate (in hard copy).
8. Upon receiving the communication on compromising cryptographic keys from the EDCS Participant, the EDCS Organizer’s Security Administrator will contact the EDCS Participant to confirm the information received. If compromise is confirmed, the EDCS Organizer’s Security Administrator includes the electronic signature key certificate corresponding to the compromised closed (secret) keys in the list of revoked certificates.
9. The date and the time from which the electronic signature key certificate ceases to be effective in the EDCS is the date and the time that the certificate is included in the list of revoked certificates generated by the Security Administrator.