Subject: Re: A Real Rationale for Dedicated Keys

From: [email-masked]
Date: Thu, 20 Jul 2000 11:06:04 -0400

"Simon McMahon" <[email-masked]> on 07/20/2000 05:05:01 AM

To:   <[email-masked]>, "Tony Bartoletti" <[email-masked]>
cc:
Subject:  Re: A Real Rationale for Dedicated Keys

> My point being, the key-owner is the primary point of
> control in enforcing a "one-key, one-cert" personal regime.
>
The "key generator" is really the primary point of control and need not be
the same as the "key owner" (the one who makes signatures). Some CAs insist
on having some control over key origin, key generation, or at least the
equipment used to do it so that uncontrolled certifications and hackable
private keys can be avoided. I would expect that all commercial CAs that
generate certs intended for NR usage will have to control key generation.

Does it really matter how many certificates there are for a public key as
long as the one specifying NR relates to a private key that cannot be
duplicated ? I dont see how multiple certs for a key is a threat to
non-repudiation of signatures. Only private key exposure / duplication is.

[Tom Gindin] The threat is that the subject could claim, as an attempt to
repudiate, that he was using an ordinary authentication key, and he didn't
know that it was for NR.  For this reason and similar ones, having multiple
certificates with conflicting key usages but the same key is surely bad
practice - having multiple certificates with the same key usages and the
same key from different issuers is much less so.  There is a converse
threat, in that an untrustworthy CA could (in theory) issue certificates
for users it has no relationship with, based on existing valid
certificates, but with stronger key usage and an RP could claim reliance on
such certificates.  Then the CA goes out of operation and the RP claims
non-repudiation.

Regards,

Simon McMahon.
ERACOM Pty. Ltd.

---

From: "Simon McMahon" <[email-masked]>
Date: Fri, 21 Jul 2000 10:28:21 +1000

> such certificates.  Then the CA goes out of operation and the RP claims
I think reputable CAs will counter this threat by controlling key pair
generation and private key storage or by making subjects declare (backed up
with a handwritten signature) that the key they have presented for an NR
certificate will only ever be certified for NR use.

I dont think the concept of an "untrustworthy CA" is a realistic threat to
consider. Why would anyone trust certificates from an untrustworthy CA ?