Subject: Re: German Law and OCSP

From: Stefan Kelm <[email-masked]>
Date: Thu, 24 Feb 2000 14:47:31 +0100 (MET)

Denis,

> > Once such a division is made technically, it was extended to the idea
> > that a certificate should only be valid once it is inserted in the
> > information service database.
>
> I do not understand. To be "valid" a certificate does not (even)
> have to be published. It may be given back to the user who may
> decide to send it to whatever entity he wishes.

you're certainly right. However, the German Digital Signature Act states:
[from http://www.iid.de/rahmen/iukdgebt.html#a3]

§ 5: Issue of Certificates

(1) The certification authority shall reliably establish the identity of persons applying for a
certificate. It shall confirm the assignment of a public signature key to an identified person
by a signature key certificate which, together with any attribute certificates, shall be kept
available for verification and, with the consent of the owner of the signature key, for
retrieval at all times and for everyone over publicly available telecommunication links.

The magic statement here is "...shall be kept available for verification...
at all times...". Therefore, a certificate implicitly is valid once it is
made available (from the CA's repository) for verification. Like it or
not (I don't) - that's the way the validity model was chosen to be. E.g., I've
been issued one of the very few certificates issued according to the law
but since it has not been published yet it is not valid in the sense
of the law...

The law currently is under evaluation and will be revised later this
year. It's highly unlikely that they're going to change this validity
model, though.

Cheers,

        Stefan.

______________________________________________________________________________
Stefan Kelm            PGP key: "finger [email-masked]" or via key server
DFN-PCA                                                      <[email-masked]>
Vogt-Koelln-Str. 30                               http://www.pca.dfn.de/~kelm/
22527 Hamburg (Germany)                   Tel: +49 40 428 83-2262 / Fax: -2241

---

From: Paul Koning <[email-masked]>
Date: Thu, 24 Feb 2000 09:30:23 -0500

>>>>> "Stefan" == Stefan Kelm <[email-masked]> writes:

 Stefan> Denis,
 >> > Once such a division is made technically, it was extended to the
 >> idea > that a certificate should only be valid once it is inserted
 >> in the > information service database.
 >> 

 Stefan> you're certainly right. However, the German Digital Signature
 Stefan> Act states: [from http://www.iid.de/rahmen/iukdgebt.html#a3]

 Stefan> § 5: Issue of Certificates

 Stefan> (1) The certification authority shall reliably establish the
 Stefan> identity of persons applying for a certificate. It shall
 Stefan> confirm the assignment of a public signature key to an
 Stefan> identified person by a signature key certificate which,
 Stefan> together with any attribute certificates, shall be kept
 Stefan> available for verification and, with the consent of the owner
 Stefan> of the signature key, for retrieval at all times and for
 Stefan> everyone over publicly available telecommunication links.

 Stefan> The magic statement here is "...shall be kept available for
 Stefan> verification...  at all times...". Therefore, a certificate
 Stefan> implicitly is valid once it is made available (from the CA's
 Stefan> repository) for verification. Like it or not (I don't) -
 Stefan> that's the way the validity model was chosen to be. E.g.,
 Stefan> I've been issued one of the very few certificates issued
 Stefan> according to the law but since it has not been published yet
 Stefan> it is not valid in the sense of the law...

I think that may be a matter of interpretation.  The english
translation is ambiguous as to whether "at all times and for everyone" 
applies to retrieval only, or also to verification.  The original
makes it clear the latter is correct.

One way of reading that is "any person should be able to verify the
validity of the certificate; if any communication channels are needed
for this, public one should suffice".  The standard algorithm of
checking the CA signature and the CRL is an example of such a process, 
assuming that the current CRL is available over public communications
channels.  

	paul

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 24 Feb 2000 16:04:45 +0100

Stefan,

Thanks for your comment. See my comments next.
 
> made available (from the CA's repository) for verification. 

The other magic statement is: "with the consent of the owner of the
signature key". If there is no such consent, then the statement does
not apply, hence there is no publication.

"kept available for verification" does not imply any publication. It
means that the AC must keep a local copy.

Besides the wording, the question was to understand the rational of
the model. The question is still pending ...

Regards,

Denis

> Like it or

---

From: Michael Herfert <[email-masked]>
Date: Fri, 25 Feb 2000 16:14:15 +0100

Hello Denis and all,

> the model. The question is still pending ...

The standard X.509 model does not satisfy the requierements of the german 
law. So there was a need for a new model. The important paragraphs are:

§13(5):	"The validity of the certificates issued by a certification 
         authority shall remain unaffected by the withdrawal or 
	 revocation of a licence. The competent authority may order the
     	 invalidation of certificates when facts warrant the assumption 
	 that certificates have been forged or are not adequately 
	 protected against forgery or when technical components
     	 used for the signature keys reveal security flaws enabling 
	 digital signatures to be forged or signed data to be 
	 manipulated without detection." 

§8(3):	"The competent authority shall invalidate certificates which it has 
  	 issued according to §4(5) when a certification authority 
      	 ceases operation or its licence is withdrawn or revoked."

Assume a CA looses its license, for example because it has lost its money.
According to §8(3) the competent authority (= the german root CA) 
must revoke the certificate. 

By §13(5) user certificates must remain valid if a CA looses the license.

So we have a revoked CA certificate and valid user certificates.
This case can not be handled by the standard X.509 model.

---

The SigG model is an easy and effective model.
Assume a two level hierarchy:  
	root CA
	CA
	users

1. Now Alice wants to verify 10000 digital signatures 
   with respect to the standard model.
   She decides that she needs online verification of certificates.
   For the first signature she must ask her online service three times:
     to verify the user certificate
     to verify the CA certificate
     to verify the root certificate
   So for 10000 verifications she needs 30000 requests.

2. On the other side, Bob verifies the same amount of signatures
   by the SigG model.
   He first verifies the CA and the root CA certificates.
   He can store the results and reuse them in the future.
   So for 10000 verifications Bob needs 10002 requests.

---

A standard X.509 directory service may be joined with the german signature law.
Alice ask this service for the certificate of Bob.
The service answers by sending Bob's certificate 
(if Bob has allowed this).
The certificate is signed by the CA, like always,
but it has no extra signature.
The meaning of the answer is: 
  Alice, this is Bob's certificate. It may be valid
  or not. If you want to know the exact status,
  ask the validation service.

If we replace the words "validation service" by "OCSP" 
then this is exact the meaning we have in the standard model.

Greetings,
Michael

---

Michael Herfert
GMD - German National Research Center for Information Technology
Darmstadt
Germany

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 25 Feb 2000 17:57:30 +0100

Michael,

Thank for attempting to answer to the question. However, the right
explanation is not contained in this E-mail where it is said: "user
certificates must remain valid if a CA looses the license", but in
the other E-mail sent to Hans Nilsson where it is said:

"The german law requires that user certificates must be valid, even
if the CA key has been corrupted."

This sentence does not appear in the extracts you provide below:

1) The first sentence of §13 (5) does not address the case of CA key
compromise.

2) The second sentence of §13 (5) orders invalidation of
certificates which is in contradiction with maintaining the validity
of certificates, even if the CA key has been corrupted.

3) The sentence of §8(3) talks about invalidation, not maintaining
the validity of the certificate.

The fact that by §13(5) user certificates must remain valid if a CA
looses the license, does not mean that the CA key is compromised. A
CA may loose its license without any key compromission.

The idea is nevertheless to consider the way to handle the case of
CA key compromission. 

The basic question is whether there is a need to modify RFC 2459 to
handle CA key compromission. If there is such a need, this cannot
interpreted from this text.

Denis