Subject: Key Recovery in PKIX CMP

From: "Rachel" <[email-masked]>
Date: Sat, 6 Oct 2001 10:29:37 +0800

Hi all,

I have some questions here regarding the PKI messages used for key recovery purposes.
They are Key Recovery Request and Key Recovery Response messages.
According to RFC2510 and RFC2511, the key recovery request is of type CertReqMessages and
KeyRecRepContent respectively.  My questions are:

1) Why the key recovery request is made identical as cert request format ? I can't see both of them
have the same nature.Cert request is used when someone want to register for his new key pair.  In
order to complete that, one has to send in the CertTemplate with all those necessary fields filled
in, also, he has to provide Proof-of-Possession about his key pair.  Now, if we look at the typical
procedure for a key recovery system (or key escrow system), anyone (the owner of the key, a third
party) can issue a request for the recovery of the key.  In this context, does the key recovery
requester need to send in the cert template again ?  Also, how can an authorised third party
presents his POP of the key to be recovered (although he is not the owner, but he has the right to
do so) ??

2) The 2nd question is about the key recovery response PKI message.  Does anyone know why
newSigCert, caCerts and keyPairHist is returned to the recovery requester ?  And can you explain the
scenario is which the new signature certificate should be returned and why ?  The RFC I have do not
cover that, I mean the explanation on the existance of a particular field.

Hope to hear from you soon.  Thanks in advance.

regards,
Rachel
UTM