Subject: [TLS] key exchange with RSA Certificate based keys

From: Robert Withers <[email-masked]>
Date: Sat, 16 Sep 2006 13:02:26 -0700

Hi!   I am new to TLS and new to the list.  I am implementing a  
client and server to the TLS 1.1 spec and I have run into an issue  
that is stumping me.  Hopefully this is the right list and someone  
can help.

I am implementing support for TLS_RSA_WITH_3DES_EDE_CBC_SHA and so  
the handshake negotiation is expected to be:

[client]
ClientHello
[server]
ServerHello
Certificate
ServerHelloDone
[client]
ClientKeyExchange
ChangeCipherSpec
Finished
[server]
ChangeCipherSpec
Finished

The RSA keys inside of the SubjectPublicKeyInfo of the certificate  
are to be used to encrypt the preMasterSecret by the client and sent  
in the ClientkeyExchange.  My question is how does the server  
unencrypt the key?   Does he have the RSA private key somewhere and  
how did he get them.

I have an RSA signed certificate and I do not have private keys.  If  
I am to generate these keys, and write the new public keys into the  
certificate before sending it, doesn't that invalidate the CA signature?

Thank you,
Robert

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: <[email-masked]>
Date: Mon, 18 Sep 2006 10:57:17 +0300

> that is stumping me.  Hopefully this is the right list and someone  

BTW, it's good to keep in mind that while implementing TLS is not very
difficult, implementing it correctly and securely is.  Serious bugs
have been found in practically all TLS implementations.

So if you care about security, you should consider using some existing
implementation where many of the bugs have already been found and
fixed.

> unencrypt the key?   Does he have the RSA private key somewhere and  

Yes, the server needs the RSA private key corresponding to the public
key in the certificate. (If this was not the case, anyone who knows
the certificate could impersonate the server!)

The most common case would be that the server (administrator)
generated the key pair (private and public) earlier, sent the public
key to the CA in a certificate request, and got the certificate back.

> certificate before sending it, doesn't that invalidate the CA 

Yes, it would invalidate the signature. You need to first generate
the key pair, and then submit the public key to the CA.

Best regards,
Pasi

---

From: Robert Withers <[email-masked]>
Date: Mon, 18 Sep 2006 10:57:10 -0700

Hi Pasi, thanks for your reply.

> implementation where many of the bugs have already been found and

This is a very important point.  I have had fun implementing TLS so  
far, even though I keep getting a bad record mac error for some  
mysterious reason to be discovered, when connecting to a secure  
server like cacert.  :-)   There are sure to be many holes,  
especially since I haven't built support for all of the correct Alert  
generation conditions.   It is a work in progress.

Yet, we have an interpreted environment known as Squeak.  It runs bit  
identically on Windows, Mac and *nix.  In bringing native support to  
this environment, we would avoid requiring platform specific  
configuration and it would just work.  Our implementation is  
developing well, connectivity hiccups aside, and provides a service  
to Squeak that would be difficult to obtain otherwise.  We do run  
this risk of having many serious security bugs, but like any  
implementation, sufficient use would expose them for correction.  We  
introduce this work with this in mind.

> key to the CA in a certificate request, and got the certificate back.

This would be why OpenSSL provides the ability to generate key pairs,  
then.  I just need to find the second half of that pair.  Do most  
implementations provide the ability to generate key pairs and then  
have the public key placed in CSR form for signing?   Perhaps we need  
to provide that capability.

> the key pair, and then submit the public key to the CA.

Yes, and further I read that no defined CipherSuites support  
temporary RSA keys through the ServerKeyExchange.

many thanks,
Robert

---

From: <[email-masked]>
Date: Tue, 19 Sep 2006 09:35:39 +0300

Robert Withers wrote:
> 
> This would be why OpenSSL provides the ability to generate key
> pairs, then.  I just need to find the second half of that pair.  
> Do most implementations provide the ability to generate key pairs 
> and then have the public key placed in CSR form for signing?  
> Perhaps we need to provide that capability.

Yes, I'd say most implementations include this capability, often in
some kind of command line tool (e.g. OpenSSL's "req" command, Mozilla
NSS's "certutil", Java SDK's "keytool", GNU TLS's "certtool", and so
on).

Best regards,
Pasi