Subject: RE: generation of private keys

From: Carlisle Adams <[email-masked]>
Date: Fri, 27 Nov 1998 12:46:26 -0500

Hi Warwick,

A couple of quotes (from W. Ford, "Computer Communications Security:
Principles, Standard Protocols and Techniques", pp.97-98):

"To minimize vulnerabilities, the key generation process is best carried out
either within the owner system or within the certification authority system,
thereby necessitating only one protected key transfer."

"If keys are generated with the certification authority system, transfer of
the private key to the owner system will require both integrity and
confidentiality protection.  In either case, if key archiving is required,
reliable copies of both keys will need to be sent to an archiving system
(which may be co-located with the certification authority system)..."

Not a word about "highly undesirable", "questionable security practice", or
"might be O.K., subject to complete risk analysis".  What could have
happened in the past couple of years to cause you to alter your view so
radically?

In any case, we are in full agreement that all options should be left open
(in order to suit the needs of all environments).  I'm not sure what
"technical protocol" you're referring to below, since Stefan's suggestion
was simply to add an extension to a Certificate, but an enumeration rather
than a Boolean is perfectly fine with me.

Carlisle.

-----Original Message-----
From: Warwick Ford [mailto:[email-masked]]
Sent: Friday, November 27, 1998 9:29 AM
To: 'Carlisle Adams'
Cc: [email-masked]'
Subject: RE: generation of private keys

Hi, Carlisle:

No, I would not restrict my comment to only the situation you describe.
Even within one organization it is generally good security practice to
separate security functions such as certification and key management.  This
may, of course, be of varying importance in different environments and,
admittedly, may not be a requirement at all in some organizations, subject
to complete risk analysis.

I think we should leave all options open, but I would not want to bias the
technical protocol in favor of a questionable security practice.  Therefore,
if we were to do anything, I would prefer Stefan's extension with an
enumeration rather than just a Boolean.

---

From: Dan Geer <[email-masked]>
Date: Mon, 30 Nov 1998 10:47:03 -0500

> What could have happened in the past couple of years to cause you
    > to alter your view so radically?
    
"Do I contradict myself?
Very well then....I contradict myself;
I am large....I contain multitudes."
       --Walt Whitman

As to the point about marking who generated the keys,
either it has to be a falsifiable hypothesis or it has
to carry warranty of/by the CA.  Since there is no way
to make the hypothesis falsifiable and since the CA is
in the random warranty business anyway (or the RA is,
small difference), then this is the CA's opinion and
either it stands behind it (warranty) or it does not.
I certainly wouldn't treat it as a hint -- who the 
hell would take a hint on something as crucial as 
whether this set of keys was gen'd by XYZ?  Of course,
whether gen'd on the up-and-up or not, incompetently
escrowed trumps competently gen'd any day.

Bottom line:
one bit answer to _CA_takes_responsibility_for_key_gen?_

contradictorily speaking,

--dan