Subject: several key in same certificate

From: [email-masked]
Date: Wed, 10 Nov 2004 14:00:22 +0100

Hi, 

it is possible to have several key in the same certificate ?
if so, which document refers to that.

Thanks
Yann

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Wed, 10 Nov 2004 15:12:25 +0100 (CET)

In message <[email-masked]> on Wed, 10 Nov 2004 14:00:22 +0100, [email-masked] said:

yquenechdu> it is possible to have several key in the same certificate ?
yquenechdu> if so, which document refers to that.

Well...  if we use our imagination a little bit, it's perfectly
possible to have more public keys in certificate extensions :-).
There's no document that I know covering this, as the idea came
to my mind just now, prompted by your question.  I've no idea if
someone has done something like that or not...

So, in all seriousness, I will assume that you're really asking about
public keys that are used for certificate verification, and in that
case, what you ask is certainly not possible, and it should be
apparent if you read RFC 3280 or X.509 accurately.

Now, to get a real discussion going (if you want), why do you want to
have more than one public key in your certificate?  What would they be
used for, and most specifically, how would the appropriate key be
selected for the operation you want to perform?

Cheers,
Richard

-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.

-- 
Richard Levitte     | http://richard.levitte.org/ | Tunnlandsv. 52
Levitte Programming | http://www.lp.se/           | S-168 36 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 10 Nov 2004 16:59:11 +0100

>if so, which document refers to that.
Hi, Yannick.

The one-to-one relation between a cert and a public key is really deeply 
grounded in x509.

The problems that makes one want to have several keys inside one cert 
should be solved by using several certificates that will be handled as 
equivalent by the PKI software, and correct any problem in the software 
that makes this not feasible. Especially restrictions on having several 
certificates with the same DN.

This rejoins what is being discussed here since a while : Two CA certs 
with the same DN from the same issuer ? They represent the same CA 
entity and must treated as such. The same applies for the end-user.

---

From: [email-masked]
Date: Wed, 10 Nov 2004 17:42:20 +0100

thank you for your preceding answer 

> apparent if you read RFC 3280 or X.509 accurately.
I know RFC3280, I thought that perhaps somebody with have the idee of such a
process. 

> selected for the operation you want to perform?
Because currently I have several keys (certificates) for the same entity. Each
certificate allows a particular function (different extendedKeyUsage and KeyUsage) 

 I wondered whether the IETF, there a had been a reflexion, to extend a
certificate containing only one identity with several key and of the specific
extensions by keys.

An application could according to Keyusage and ExtendedKeyusage to take the good
key for for example applying a signature.

Thanks
Yannick Quenec'hdu

---

From: Stephen Kent <[email-masked]>
Date: Wed, 10 Nov 2004 16:54:32 -0500

>if so, which document refers to that.

the short, simple answer is no.

a longer answer follows:

For CA certs this would be a very confusing situation, and so I do 
not expect to see this construct approved. we have enough complexity 
with path processing and the potential for a CRL to be signed by a 
key other than the one used to sign a cert beng checked against said 
CRL ...

For EE certs, I know of one instance where a lagre PKI did put two 
keys into one cert: one key for signature and one for encryption, for 
e-mail.  It was messy, but invisible to the path validation logic, so 
it was not so awful. Still, one could not use the keyusage extension 
say which key was for which purpose, which illustrates the sort of 
problems that arise when one tries to do something like this.

Steve

---

From: [email-masked]
Date: Wed, 10 Nov 2004 17:42:20 +0100

Thanks
Yannick Quenec'hdu

---

From: Stephen Kent <[email-masked]>
Date: Wed, 10 Nov 2004 16:54:32 -0500

a longer answer follows:

Steve

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Wed, 10 Nov 2004 15:12:25 +0100 (CET)

Cheers,
Richard

-----