Subject: Re: Certificate requests for encryption keys

From: "Brian M. Thomas" <[email-masked]>
Date: Tue, 8 Jun 1999 13:48:58 -0500 (CDT)

An EE's assertion is both necessary and sufficient to bind an
encryption key to itself.  There is therefore neither need nor
justification for a CA's involvement.  As to someone else's
authorization to use that key for encryption (as in key recovery
scenarios) that is another matter, and only meaningful if the CA is
also the authority (e.g.  employer) authorizing it to be used for that
purpose.

brian

Brian Thomas, CISSP - Distributed Systems Architect  [email-masked]
Southwestern Bell                                    [email-masked]
One Bell Center,  Room 34G3                          Tel: 314 235 3141
St. Louis, MO 63101                                  Fax: 314 235 0162

---

From: Stephen Kent <[email-masked]>
Date: Tue, 8 Jun 1999 15:52:48 -0400

Brian,

An EE's assertion about binding any key (encryption or signature) to
itself, in the form of a self-signed cert, says little from a security
perspective.  What we are discussing here is whether an EE with an existing
signature key should use it to issue certs for encryption keys.  Yes, one
can do that, but it adds more complexity to key management.  For some apps,
e.g., S/MIME, one wamnts a long term encryption key, for the purposes I
mentioned in my note to Anne.  If there are other Internet applications
that need shorter duration encryption, but not authentication, keys, then
the PKIX WG needs to hear a good description of them, to warrant
appropriate accommodation in our standards.  Note that in places where PFS
is a goal, one can avoid the need for certs entirely for encryption
purposes, e.g., IKE.

Steve