Subject: Re: Qualified Certificate Requests - Signature vs. Certificate

From: Stephen Henson <[email-masked]>
Date: Thu, 04 Aug 2005 00:29:19 +0100

Philipp Gühring wrote:

> 
>>>Including a certificate as an OCTETSTRING into a CSR?
>>
>>Note the "or a reference to one" including a URI where it could be
>>downloaded would have a smaller overhead.
> 
> 
> The problem is that the scenario is a normal user requesting a qualified 
> certificate. 
> The keypair is generated directly before the request is sent. If it were 
> generated by the vendor before, it would make sense to put the certs on a 
> server. But that´s not the case.
> And the request should be processed as fast as possible. I don´t see where a 
> normal user has a webserver available, where the PKCS#11 driver or CSP could 
> upload the certificate. And I don´t think that the user will be happy doing 
> that himself.
> So referencing an external certificate is not an option, I would say.
> 

I should've qualified the statement. Its clear now I've read the full
details that a certificate isn't appopriate to sign the public key of a
smart card key. Where it might be appropriate is in signing the vendor's
key for trust purposes, see below.

> 
>>Ah now that's another issue. Would this "vendor key" be the same on each
>>smartcard or different for each one? Presumably it would have to be
>>different for each vendor?
> 
> Every vendor has his own key, or a couple of keys, perhaps one for each kind 
> of device the vendor produces. Let´s say normally a vendor should have <10 
> keys. But definitly not for every single device.
> 

So how does a CA processing the CSR and vendor key know that it can
trust the vendor's key?

That's a case where I believe certificates could have a role. An
authority could certify each vendor key and the vendor would include
references to this information in the form of a URI on its site.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.