Subject: RE: generation of private keys

From: Stefan Kelm <[email-masked]>
Date: Wed, 25 Nov 1998 10:57:20 +0100 (MET)

Tony,

> >Interesting question.  My initial reaction is to wonder if a new certificate
> >extension is really the right solution for this.  If the CA generates the
> >key pair, it can certainly populate such an extension with confidence.
> >However, if the CA did not generate the key pair, how will it distinguish
> >between EE, RA, and "other" (i.e., how will it know (with certainty) who did
> >the actual key pair generation so that it can populate the extension)?
> >
> >Carlisle.
>
> It seems the most a CA could do is indicate either that it did, or did not
> generate the keypair, correct?

You're probably right. So it comes down to a boolean indicator. Do you agree
that such an indicator would be a useful enhancement?

If we don't use an extension, what other means would we have to indicate
the key generation location?

Cheers,

        Stefan.

______________________________________________________________________________
Stefan Kelm            PGP key: "finger [email-masked]" or via key server
DFN-PCA, University of Hamburg                               <[email-masked]>
Vogt-Koelln-Str. 30                               http://www.pca.dfn.de/~kelm/
22527 Hamburg (Germany)          Tel: +49 40 5494 2262 / Fax: +49 40 5494 2241

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 25 Nov 1998 15:31:21 -0800

>the key generation location?

Stefan,

Beign unfamiliar with the German Dig-Sig Law, it is hard to say.
I can see no harm from such an extension.  In the case where "law"
requires that "key-gen-authorhood" be positively identified, this
would tend to make CA-key-generation somewhat mandatory, but then
law is law.

I was trying to think of some way that keys, (or simply random
numbers) could be generated in a way that each generator "inserts"
its ID into each number, while not affecting the randomness (i.e.,
predictability) in any significant way.

I'm still thinking...;)

___tony___

Tony Bartoletti                                             LL
SPI-NET GURU                                             LL LL
Computer Security Technology Center                   LL LL LL
Lawrence Livermore National Lab                       LL LL LL
PO Box 808, L - 303                                   LL LL LLLLLLLL
Livermore, CA 94551-9900                              LL LLLLLLLL
email: [email-masked]   phone: 510-422-3881             LLLLLLLL