Subject: Updating POP in CMC

From: Stefan Santesson <[email-masked]>
Date: Thu, 15 Mar 2007 17:36:34 +0000

NIST has done an update to SP800-56A

In Section 5.6.4.2, the second item was originally as follows:
"A static key pair may be used in more than one key establishment scheme. However,
one static public/private key pair shall not be used for different purposes (for example, a
digital signature key pair is not to be used for key establishment or vice versa)."

This text has now been amended with the following text:

with the
following possible exception: when requesting the (initial) certificate for a public static
key establishment key, the key establishment private key associated with the public key
may be used to sign the certificate request. See SP 800-57, Part 1 on Key Usage for
further information."

I think this is a most welcome amendment to the possibilities to do efficient POP for key agreement and key encryption keys without having to do multi roundtrip POP.

CMC(bis) has been handed over to the IESG, but as many changes has been requested by IESG review, I have been told that it needs to go back to the WG for re-approval.
This is an opportunity for us to also incorporate the option of 800-56 into the use of CMC.

I will make a proposal for changes and post it to the list.

Stefan Santesson
Senior Program Manager
Windows Security, Standards