Enrolling key holders
RSA-4096 keys are generated in the browser; only the public key reaches the server.
Key holders are the people (the supervisory body) entitled to decrypt reports. For each one an RSA-4096 key pair is generated directly in the browser.
- Start a key holder enrollment from the channel.
- The browser generates the key pair and shows a recovery phrase (mnemonic).
- The key holder saves the mnemonic and downloads the encrypted private key file.
- Only the public key is sent to the server.
Enrolled key holders are required for the channel to receive reports. The private key never leaves the key holder’s browser.