Subject: Re: "Subject Alternative Name" v/s "Subject/Serial Number"

From: [email-masked] (Peter Gutmann)
Date: Mon, 28 Jan 2002 17:05:54 +1300 (NZDT)

"Al Arsenault" <[email-masked]> writes:

>The Government of Hong Kong wanted to include the Hong Kong Identifier (HKID,
>a unique string assigned to each authorized resident of the SAR) in
>certificates.  But, the HKID is by law "private data"; its use or disclosure
>outside of carefully delineated circumstances is a violation of law. So
>putting the ID in the certificate was a non-starter - certificates are public
>data.
>
>So how did they do it?  Check out
>
>http://www.hongkongpost.gov.hk/5digital/dc4_fr.html
>
>Specifically, the details are given in footnote 6 on page 48  of the 27 August
>2001 CPS.

And to save everyone else having to chase this down as well, it's:

The subscriber’s HKID number (hkid_number - including the check digit) will be
stored in the certificate in the form of a hash value of the HKID number
(cert_hkid_hash) which has been signed by the private key of the subscriber:-
cert_

hkid_hash = SHA-1 ( RSAprivatekey, sha-1 ( hkid_number ) )

where the SHA-1 is a hash function and RSA is the signing function

For key generation by subscribers, hkid_number will be signed at the
subscriber’s browser. For Central Key Generation, hkid_number will be signed
during the key generation process at HKPost premises. The signed HKID Number -
RSAprivatekey, sha-1 ( hkid_number ) - will be passed to the Hongkong Post CA
system through a secure channel. Upon verification of subscriber data at CA
system side, the CA system will create a hash of the signed HKID number - SHA-1
( RSAprivatekey, sha-1 ( hkid_number ) ). The hash value will then be put into
the designated extension field (DNSname) of the certificate being generated.

Peter.

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 28 Jan 2002 10:28:21 +0100

Thanx Peter,
That was a truly elaborate scheme! 

In what way is this better than the brutally simple solution used in Finland,
where a proxy-number stored in serialNumber, is mapped by the authorities
that has access to a CA-maintained mapping directory, to get the personal
(more or less secret) id?

In particular, does this scheme offer a permanent identifier also for non
"HKID-permitted" RPs? I does not seem like that.  That was maybe a
part of the design not to?

Actually, I don't understand how a "HKID-permitted" RPs can
extract the HKID without asking the CA for help.  If that's the case,
even the hashed HKID seems redundant, as each certificate must
anyway be "recorded" together with its associated HKID?
 
Doesn't the client side need special SW to perform the signing of
HKIDs?

Regarding Al's comment that certificates are public, this is not entirely true,
as at least in Sweden, certificates are not stored for general access.  I.e.
certificates are (at least theoretically), only transferred to trusted parties
of the subject.

Anders

----- Original Message ----- 
From: "Peter Gutmann" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Monday, January 28, 2002 05:05
Subject: Re: "Subject Alternative Name" v/s "Subject/Serial Number"

The subscriber's HKID number (hkid_number - including the check digit) will be
stored in the certificate in the form of a hash value of the HKID number
(cert_hkid_hash) which has been signed by the private key of the subscriber:-
cert_

subscriber's browser. For Central Key Generation, hkid_number will be signed

Peter.