Subject: RE: generation of private keys

From: Stefan Kelm <[email-masked]>
Date: Thu, 3 Dec 1998 14:47:51 +0100 (MET)

Hallo Juergen,

> I would like to add few comments to the key generation extension. It was
> suggested to give the relying party a hint at the assurance level of the
> certificate adding a key generation extension to the profile in [PKIX
> CERT].
>
> The suggested key generation extension represents only one aspect of
> certification policy. It SHOULD be stated in the CPS of the issuing CA.

I absolutely agree. Still, some CAs might not state anything about the
key generation location in their policy (or CPS, respectively), or the
policy allows the keys to be generated at either side (e.g. the German
digital signature law where CAs probably won't have their own policy).

Why not consider the suggested extension as an additional mechanism?
As I said in my first mail I don't think this is a pure policy issue.

> There are two extensions refer to the underlying policy in the
> certificate, the CPS pointer and User Notice qualifiers.
>
> The relevant text taken from[PKIX CERT] and [PKIX CPS] follows at the
> end of the message.
>
> The disadvantage of these extensions I see is that they are not
> customizable for automatic processing. Even the reading and
> understanding of CPS may be difficult. Supposed if there any need for a
> key generation extension for some communities nowadays; next year there
> may be some need for another extension refering to other elements of CPS
> in a formal and automatically customizable representation.
>
> Is this the way we want to go?

I don't think that this is the point. I can follow your arguments but I
do think that there are certain issues (like the key generation location)
that may be considered important enough to specify a dedicated extension
or some other means. Personally, I think that the key generation location
is one of the crucial points of every PKI, hence my suggestion.

> Surely, I can live with a key generation extension as a boolean or
> whatever. But I can not recommend use of this extension in such a way
> that the relying party only sticks on this to decide whether accept a
> certificate or not under certain circumstances. A look on the whole CPS
> is strongly recommended.

Agreed.

> [...]
> Finally, I do not see that the German digital signature law implies the
> usage of a key generation extension. [...]

Indeed it doesn't.

Cheers,

        Stefan.

______________________________________________________________________________
Stefan Kelm            PGP key: "finger [email-masked]" or via key server
DFN-PCA, University of Hamburg                               <[email-masked]>
Vogt-Koelln-Str. 30                               http://www.pca.dfn.de/~kelm/
22527 Hamburg (Germany)          Tel: +49 40 5494 2262 / Fax: +49 40 5494 2241

---

From: Juergen Walter <[email-masked]>
Date: Fri, 04 Dec 1998 15:27:25 +0100

Hallo Stephan,

comments in line,
> digital signature law where CAs probably won't have their own policy).

[Juergen] This is a prudent practice that CAs have their own policies.
Even if the CA does not publish its policy there is still a policy
behind the scene. The relying party either trusts in a CA or not at a
certain level of assurance. [Juergen]
> As I said in my first mail I don't think this is a pure policy issue.
[Juergen] I tend to disagree. I would not hilighten the location of key
generation feature. Every further extension will lead to long vehicle
certificates. I do not see that it is an additional mechanism. The
authentication of the cryptograhic module generating the key and the
identification of the individual who takes control over this process
would be a better extension providing there is any need for this.
[Juergen]

> I don't think that this is the point.

[Juergen] I agree. But I think that your suggestion is the first step
into this direction.

> I can follow your arguments but I

[Juergen] I disagree. Even if the key is generated by the CA there might
be many snares during the life-time of end entity`s private key. If the
end entity uses a insecure cryptographic module for storing his private
key, it does not matter that the CA properly generates the key. The key
management that you probably have in mind is this, that the CA
distributes a smart card including a key generated by the CA. Does your
`location_of_key_generation = CA` then imply this? In this case I think
that the serial number of the smart card is a good candidate for the
extension. If I remember right, this extension is suggested in the
Interoperability Guide Draft published by the Bundesamt fuer Sicherheit
in der Informationstechnik (BSI Germany), but I am not sure.

The longer I am thinking about the location_of_key_generation extension
the more I am worry about it. 
Can you point out to me what your CA guarantees if the
`location_of_key_generation = CA` is included in the issued certificate?
[Juergen]

-- 

Juergen