Subject: Key Recovery in the CMP (RESEND WITH LINE FEEDS)

From: Sarbari Gupta <[email-masked]>
Date: Thu, 21 Jan 1999 14:31:54 -0500

I had several comments related to the treatment of key recovery in the
CMP document. I realize that these comments would have applied to the
last version of CMP - however, I did not get a chance to send these out
in time.

Since there appears to be little or no explanation on how a key recovery
request operation is typically performed, I was forced to make my own
assumptions, and base my comments upon those assumptions. The primary
point I would like to make is that the handling of key recovery in the
current CMP document is much too terse, and, depending upon the
assumptions and envisioned scenarios, the message syntax may be
incomplete or even flawed. I personally think that the key recovery
portion of CMP needs to be reworked and expanded. 

My specific comments follow: 

I) In section 3.3.7, under key recovery request message: 

Comment 1: The CMP document says, "For key recovery requests the syntax
used is identical to the initialization request, CertReqMessages." I
would contend that key recovery is dissimilar enough from initial
certification request that it deserve a more targeted message syntax.
For example, the CertReqMessages syntax in CRMF has an optional
ProofOfPossession field that is in inapplicable for key recovery (how
can you prove possession of a private key that you are trying to
recover??) Conversely, the CertReqMessages syntax does not appear to
support a field that will allow the requester to pass authorization
information (such as a passphrase or authentication token) to the CA. I
would recommend that the syntax for a new message, KeyRecoveryReq, be
defined to specifically address the required fields for key recovery. I
would be happy to supply this new syntax if there is agreement on this
issue.  

Comment 2: The sentence "Typically, SubjectPublicKeyInfo and KeyId are
the template fields which may be used to supply a signature public key
for which a certificate is required" has many inconsistencies. First,
key recovery requires key identification, and not templates. Second, why
would I want to supply my signature public key for key recovery instead
of my encryption public key? Third, it says, "a certificate is required"
as the intended goal of key recovery - in actuality, a private key is
required. This sentence should be rewritten to something like: "
Typically, the SubjectPublicKeyInfo and KeyId fields are used to
identify the private key for which recovery is required."

II) In Section 3.3.8, under Key recovery response content: 

The syntax for the response message is specified in CMP as:
  >>KeyRecRepContent ::= SEQUENCE { 
  >>	status PKIStatusInfo, 
  >>	newSigCert [0] Certificate OPTIONAL, 
  >>	caCerts [1] SEQUENCE SIZE (1..MAX) OF Certificate OPTIONAL, 
  >>	keyPairHist [2] SEQUENCE SIZE (1..MAX) OF CertifiedKeyPair

OPTIONAL }

Comment 1: The key recovery request message identifies the single key to
be recovered. Yet, the response message, (surprisingly) returns a new
signature certificate, and a sequence of key pairs. I understand that in
certain implementations of key recovery, the signature key is
automatically regenerated when an encryption key is recovered. However,
either there needs to be extensive explanation on this issue, or the key
recovery response syntax needs to be decoupled from the issuance of new
signature certificates. The current syntax and accompanying explanation
does not hang together.

Comment 2: CertifiedKeyPair syntax contains the (recovered) private key
as an EncryptedValue. Should this be EncryptedKey instead? Assuming that
the private key is encrypted (by the CA) with a symmetric key - how is
that symmetric key transported to the requester? We have to assume that
the requester does not have access to his encryption private key - (why
else would he request key recovery??) - therefore, normal key transfer
mechanisms cannot be used. Possibly, the symmetric encryption key that
is used to encrypt the recovered private key, could have been passed in
through the key recovery request message. However, the CertReqMessages
syntax does not seem to support the passing of a symmetric key to be
used to encrypt a private key returned by the CA. 

Best regards, 

- Sarbari Gupta 

=================================
Sarbari Gupta
CygnaCom Solutions
(703)848-0883 (voice)
(703)848-0960(FAX)
[email-masked]
=================================