Subject: Re: Key Compromise, Rollover and Loss (was Re: Hash Algorithm Agility viaCertificate/CRL/OCSP Extensions)

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 6 Oct 2006 14:26:39 +0200

Rob and the co-chairs,

(...)°

>That's where my idea comes in.  By putting additional hashes (generated by a 
>variety of hash algorithms) into a non-critical Certificate Extension, and by 
>requiring (or at least recommending) new software to check *all* of these 
>additional hashes, I believe that we could accomplish all of these goals.

>Each certificate's signature would continue to be generated using 
>sha1WithRSAEncryption, allowing current applications to continue to work 
>without any code changes.  These current applications would simply ignore the 
>non-critical "Additional Hashes" Certificate Extension.

>If SHA-1 is ever sufficiently compromised, then we can expect attackers to 
>create fake certificates using sha1WithRSAEncryption signatures from valid 
>certificates.  My hope is that new software would be able to detect and 
>reject these fake certificates, simply by checking all of the hashes in 
>the "Additional Hashes" extension.

>Do you think my idea is worth considering at all?

Since you asked ....

This would mandate to develop a new piece of software that is likely to be never used 
(and tested). This is not a good idea. 

Since every PKI should have a Disaster Recovey Plan ready, in particular in case 
a given algorithm or key length is broken, it would be much better to rely on that plan 
which will address wider concerns.

The remaining of my reponse is that is would be more beneficial, if the WG agrees, 
to develop an RFC to address: Key Compromise, Rollover and Loss. See my previous 
e-mail for the abstract.

Now a message to the co-chairs. Do you think it would be appropriate at this time
to start a work-item adressing "Key Compromise, Rollover and Loss". The original title was
"Planning for PKI Disaster" but was thought to be too frightening, so why it has been changed.
 A more appropriate title would be: "PKI Disaster Recovery Plan".

Denis