Subject: Re: keyIdentifiers

From: "Rich Ankney" <[email-masked]>
Date: Tue, 3 Nov 1998 19:04:34 -0500

I'm concerned that this is changing what's in X.509; people (not
CertCo:-) may have implemented to that.  It would be better to
define a separate extension for a unique key ID...

Regards,
Rich

----------
> From: Simonetti David <[email-masked]>
> To: Kevin Kingdon <[email-masked]>
> Cc: [email-masked]'
> Subject: Re: keyIdentifiers
> Date: Tuesday, November 03, 1998 6:21 PM
> 
> Kevin,
> 
> I believe the key identifier is intended to be universally unique.  The
> profile does not state this.  However, I recall a presentation where
> someone was proving mathematically that taking 60 bits out of a SHA-1
> hash of the public key would provide sufficient uniqueness.  What is
> sufficient?  It was a very, very, very small fraction for a very, very
> large number of certificates.  Sorry for the generalities, but I'm not a
> mathematician.
> 
> Dave S.
> 
> Kevin Kingdon wrote:
> > 
> > One issue that does affect applications is the scope of a key
identifier. Is
> > it unique for a given subject, a given CA, or globally unique? In other
> > words, can I build a certificate chain using just key identifiers, or
do I
> > have to use some combination of subject + identifier or issuer +
(subject)
> > identifier to build the chain? X.509 says the first case (unique only
with
> > respect to a given subject). Does PKIX expand the scope of the
identifier to
> > one of the other two levels I mentioned?
> > 
> > -----Original Message-----
> > From: Marc Branchaud [mailto:[email-masked]]
> > Sent: Tuesday, November 03, 1998 11:59 AM
> > To: [email-masked]
> > Subject: Re: keyIdentifiers
> > 
> > -----BEGIN PGP SIGNED MESSAGE-----
> > 
> > Content-Type: text/plain; charset=us-ascii
> > 
> > Robert Moskowitz <[email-masked]> scrawled:
> > >
> > > Not according to a presentation Chicani gave to the federal PKI TWG
back
> > in
> > > the spring.  He was quite clear that it was an APP issue to use
> > > keyIdentifiers to build a cert chain.
> > >
> > 
> > Sure, but the app doesn't have to construct any key identifiers, just
use
> > the ones that are already in the certs.
> > 
> > > Then last week Mike Myers was pointing out how an app can use
keyIdentifer
> > > for simpler processing for renewals.  Mike could better discuss this
then
> > > me remember it.
> > >
> > 
> > That's a different, and new, usage for key identifiers which I haven't
> > heard of before.
> > 
> > My point is that s'far as chain construction goes, apps don't need to
know
> > how to create key identifiers.  If key IDs are to be used for other
> > purposes, then some standard method of construction is probably a good
> > idea.  PKIX part1 (perhaps not very clearly) expects CAs to build key
> > identifiers, not apps.
> > 
> >                 Marc
> > 
> >
+------------------------------------------------------------------------+
> >  Marc Branchaud                                  \/
> >  Chief PKI Architect                             /\CERT INTERNATIONAL
INC.
> >  [email-masked]        PKI References page:             
www.xcert.com
> >  604-640-6227          www.xcert.com/~marcnarc/PKI/
> >
+------------------------------------------------------------------------+
> >   PGP key fingerprint:  60 11 4B 9D 4E E5 2F 47  BD C5 C2 BF 26 DF 5A
E1
> > 
> > -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.2
> > 
> > iQB1AwUBNj9gblrdFXNdDxPlAQFCSwL+KeJshlbX05hbLWXcE2CXB1YZt2rg4t6w
> > YBwyyKI9XI2VyXxabhO34iFtYBccLHkBB9w8Dhed81T23GojWEv8kloDoPW6RszK
> > F9EY7+6W2tp9cMoKzSmkVtOKuclc9p+g
> > =Itvv
> > -----END PGP SIGNATURE-----
> 
> -- 
> David Simonetti, Booz·Allen & Hamilton Inc.