Cryptographic key generation

Key generation is creating a cryptographic key pair: a private key (the signature creation data) and the matching public key. The security of everything built on the pair depends on how it was born: with a certified random number generator, inside protected hardware, and without any copy ever existing outside it.

For qualified services, keys are generated inside the certified HSM or QSCD itself; CA and root keys are generated in a formal, witnessed key ceremony. Weak or predictable key generation undermines a PKI at its foundation.