Subject: Re: [pkix] Possible new work item: additional methods for generating key identifiers

From: Peter Gutmann <[email-masked]>
Date: Fri, 25 Jun 2010 18:59:57 +1200

Michael StJohns <[email-masked]> writes:

>I can use the same public key in multiple certificates issued by the same CA
>each with a different SubjectName (or SubAltName).  E.g. multiple email
>addresses.  And use the same SKI for all of these certs.

This will be risky in the real world, I've seen PKIs that assume that the sKID
is unique for each cert issued.

(I'm sure one can debate endlessly over whether this is right or wrong, but in
practice if a CA reuses sKIDs and their certs are then rejected, it's going to
be the CA that has to change if it wants to play in the PKI.  So having some
text somewhere warning of this before a CA runs into it might be useful).

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 25 Jun 2010 07:43:13 -0400

I am less concerned about KID being unique for any scope.  I would like
the AKID/SKID in a valid chain to match to enhance interoperability and
to be 5280 compliant.

> -----Original Message-----
> From: Peter Gutmann [mailto:[email-masked]]
> Sent: Friday, June 25, 2010 3:00 AM
> To: [email-masked]; [email-masked]; [email-masked];
> Santosh Chokhani; [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: [pkix] Possible new work item: additional methods for
> generating key identifiers
> 
> (I'm sure one can debate endlessly over whether this is right or
wrong,
> but in
> be the CA that has to change if it wants to play in the PKI.  So
having
> some