Subject: [Cfrg] Proof of possession for encryption keys (was Re: Elliptic Curves - signature scheme (ends on April 22nd))

From: William Whyte <[email-masked]>
Date: Tue, 14 Apr 2015 15:14:30 -0400

Hi Rick,

> CAs have to do proof of possession, by verifying the signature on the CSR.

Just out of interest, can you do PoP on encryption keys if they can't
also be used as signing keys?

Cheers,

William

On Tue, Apr 14, 2015 at 2:56 PM, Rick Andrews <[email-masked]> wrote:
> Mike,
>
> You said:
>> You can probably sign (certs with a new algorithm) without hardware support, right?  You just can’t (sign certs) with a new algorithm?
>> That is, you could have the CA key be ECDSA, and the PK in the cert be *25519, right?
>
> I just want to clarify that we can't just sign any unknown key blob. CAs have to do proof of possession, by verifying the signature on the CSR. We can't do that unless the hardware or software toolkit we're using for signature verification supports the curve. So we can't today sign a PK from 25519 with ECDSA.
>
> -Rick
>
>
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg

---

From: Russ Housley <[email-masked]>
Date: Tue, 14 Apr 2015 15:35:29 -0400

> also be used as signing keys?

Yes!  It is done by establishing a symmetric key and using that to compute a MAC.

For an example see RFC 6955.

Russ

---

From: Rick Andrews <[email-masked]>
Date: Tue, 14 Apr 2015 12:40:35 -0700

> Just out of interest, can you do PoP on encryption keys if they can't also be used as signing keys?

Bill, I think there are probably protocols for doing that, but my gut feel is that most people just use CSRs signed by the encryption key (in encryption-only S/MIME certs, for example). I don't know for sure; S/MIME isn't my area of expertise.

-Rick

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Tue, 14 Apr 2015 20:41:45 +0000

On 4/14/15, 15:40 , "Rick Andrews" <[email-masked]> wrote:

>Bill, I think there are probably protocols for doing that, but my gut
>feel is that most people just use CSRs signed by the encryption key (in
>encryption-only S/MIME certs, for example). I don't know for sure; S/MIME
>isn't my area of expertise.

You can do PoP on non-signing (encryption) keys implicitly, as Russ
mentioned. AFAIK, this is *not* applicable to S/MIME.

Having said that, I personally don’t see the point: if you care to specify
Key Usage, the least you can do is adhering to it. ;)

---

From: Paul Lambert <[email-masked]>
Date: Wed, 15 Apr 2015 14:55:09 -0700

>isn't my area of expertise.
For X.509 and S/MIME yes Š but there are proposed applications with PoP by
key establishment and then subsequent signing of the key by another entity
 (I hesitate to say CA given the overloaded usage as a X.509 CA)

Paul