Subject: Dual-signed certificates

From: "Bob Jueneman" <[email-masked]>
Date: Fri, 21 Jul 2000 10:41:01 -0600

Ben,

[snip]

>Since a certificate is comprised of public information signed by a CA,
>clearly a CA can create a certificate saying more-or-less what they
>want. I suppose this is an argument for having certificates that are
>dual-signed (by the CA and the public key the contain).

Duh!  Head-slapping!  What a great idea!  I'd love to see this added to
X.509 v3 as an optional, noncritical extension.

For years, especially within the ABA, we have talked about the need
for the user to explicitly confirm acceptance of the certificate, but at present 
there is no good way to confirm acceptance, except by procedures
that are not verifiable by any relying party.  Obviously, having the user 
sign the certificate herself would confirm acceptance.

Now, granted, if a rogue CA wanted to create a bogus certificate
containing my name and their public key, they could also sign the
certificate, since they would possess the private key.

However, this threat tends to evaporate as soon as the real user signs 
something which in all likelihood only that user could have done.
and the more transactions that are signed, the more confidence that 
it really is the user -- in fact irrespective of the certificate, because the 
confidence in a signature tends to increase though repetitive use. 

As an aside, I sometimes get into arguments with people about whether, 
and how, trusted roots should be incorporated within browsers, etc.

My experience is that I often receive a signed e-mail from someone whose
root is not in my cache of trusted roots.  Because in most cases the authentication
of the user isn't exactly life and death (users who post to this list, for example),
I tend to click OK and add that root to my cache.  Now, one certificate 
authenticated by that root doesn't prove much, but by the time I've received 
three or four certificates all signed by the US DOD Medium Assurance CA,
for example, I have a greatly increased confidence that that root is bone fide.

Bob

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 24 Jul 2000 10:37:46 +0200

Bob,

Altough there has been other people commenting on your initial
message, I re-use it.

> sign the certificate herself would confirm acceptance.

There exists a way, including by a procedure that is verifiable for
every received signature by any relying party. In the stuff that got
signed, you include the identifier of the certificate. This may be
done by using CMS (or is mandated in ES 201733). There is no need to
invent a double-signed certificate.

Denis

---

From: Russ Housley <[email-masked]>
Date: Sat, 22 Jul 2000 16:13:04 -0400

Bob:

There are some significant technical issues here.  The subject cannot sign 
first because it does not know the values that will be assigned for several 
fields, like the serial number.  The subject cannot sign second 
either.  The insertion of an additional extension will break the issuer 
signature.

Thus, to proceed in this vain, complex processing must be defined that says 
which parts of the certificate a re coved by the subject signature in the 
extension.  I think that the processing is complex enough....

Russ