Password recovery & recertification

HCL Domino Domino Forum
1

An administrator with ID recovery authorization via the CA process is recertified. Via the key rollover process, his key strength is then changed from 630 bits to 1024 bits. Now, he has no longer access to the recovery information in all the user’s ID files. The only way to regain this access is by updating the recovery information in the NAB, which in turn will be pushed to all ID files. A recovery copy will then be mailed into the mailin database holding these copies.

Is this the way it should be working? Shouldn’t AdminP take be able to take care of the entire process, including renewing necessary information about authorized recovery admins after a recertification?

2

Subject: Password recovery & recertification

Unfortunately, key rollover doesn’t know that a given user is a recovery authority, so doesn’t update the recovery information stored in the certifier record. However, the old keys are still in the admin’s ID file after key rollover, and should be usable to decrypt the encrypted recovery information.

I’ve written an SPR for this problem – DKEN6Z8QRE.

Thanks,

dave