Abstract: In the PKI framework，the security and convenience of private key store and escrow depend on the administrator’s credibility or the authentication of the third party which can be used or accepted by all.Inspired by the key escrow，a scheme of private key management is designed.In the scheme，the private key and its encrypting key is separated，which makes the KMC and KEC can’t separately get the private key.Compared with other private key management scheme，the scheme is more convenient and secure and it’s security doesn’t depend on the credibility of the administrator and the third party.

Key words: Public Key Infrastructure（PKI）, Certification Authority（CA）, private key management

摘要： 在PKI体系中，私钥集中存放或私钥托管方式的安全性和方便性依赖于管理员的可信性或者需要一个各行业都能使用和接受的具有权威性的第三方托管机构。借鉴密钥托管的思想，设计了一个私钥管理方案。将加密的私钥和加密私钥的密钥分离，使得KMC和KEC都不能单独解密出私钥。与其他私钥管理方案相比，该方案安全性不依赖于管理员或第三方托管机构的可信性，更加方便和安全。

关键词: 公开秘钥体系, 证书管理机构, 私钥管理