Subject: RE: Different decryption and signature keys in PKINIT?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 18 Aug 2005 15:14:16 -0700

1 is because encryption does not always happen, not because a different
key can be used for encryption.

2 is to emphasize that the client mapping is based on the signature key,
not anything else in the AS-REQ.

-----Original Message-----
From: Aaron D. Jaggard [mailto:[email-masked]] 
Sent: Thursday, August 18, 2005 3:09 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]; Andre Scedrov; Iliano Cervesato; Joe-Kai Tsay;
Christopher Walstad; Aaron D. Jaggard
Subject: Re: Different decryption and signature keys in PKINIT?

Liqiang(Larry) Zhu wrote:
> Not in -27, if you disagree, can you point out the specific text in
-27
> that led you to believe such?
> 
> Note this is possible in some older versions.

The text at least seemed ambiguous.

From the security considerations:

   PKINIT allows the use of the same RSA key pair for encryption and
   signing when doing RSA encryption based key delivery.  This is not
   recommended usage of RSA keys [RFC3447], by using DH based key
   delivery this is avoided.

The "allows" seems to suggest that this happens sometimes, but not
always, with RSA.  Also, in 3.2.2:

   In addition to validating the client's signature, the KDC MUST also
   check that the client's public key used to verify the client's
   signature is bound to the client's principal name as specified in the
   AS-REQ as follows:

Here, "client's public key used to verify the client's signature" could
be read as allowing another key to be used for other (encryption)
purposes, and there doesn't seem to be a statement forcing equality
between the signature and decryption keys.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Aaron D.
> Jaggard

> Hi all,
> 
> As we're writing up the PKINIT binding issue it appears that, in
PKINIT
> RSA mode, the client's signature key may be different from the
client's
> decryption key.  Is this a correct reading of the various specs?
> 
> Thanks very much,  Iliano, Aaron, Andre, Joe, and Chris