Subject: RE: keyIdentifiers

From: Kevin Kingdon <[email-masked]>
Date: Tue, 3 Nov 1998 16:19:59 -0800

In a population of 2^30 certificates, there is a probability of ~50% that
some two of them will have the same 60-bit identifier. This works out to ~1
billion on my slide rule -- a large, but not unimaginable, population of
"Internet" certificates.

-----Original Message-----
From: Simonetti David [mailto:[email-masked]]
Sent: Tuesday, November 03, 1998 3:21 PM
To: Kevin Kingdon
Cc: [email-masked]'
Subject: Re: keyIdentifiers

Kevin,

I believe the key identifier is intended to be universally unique.  The
profile does not state this.  However, I recall a presentation where
someone was proving mathematically that taking 60 bits out of a SHA-1
hash of the public key would provide sufficient uniqueness.  What is
sufficient?  It was a very, very, very small fraction for a very, very
large number of certificates.  Sorry for the generalities, but I'm not a
mathematician.

Dave S.

[Snip]

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 03 Nov 1998 20:20:15 -0500

>billion on my slide rule -- a large, but not unimaginable, population of
This is why I prefer the full 160bit hash and damn the 25 byte hit on cert
size.

Speaking of cert size, what are people actually seeing in cert sizes?

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]