Subject: Re: Certificate requests for encryption keys

From: Keith Brady <[email-masked]>
Date: Tue, 08 Jun 1999 19:32:04 +0100

> I feel sure I'm going to regret asking, but why won't this work with a
> DH key?

Because you can't sign with a D-H encryption key, it can only perform
encryption operations.

Keith

---

From: Ben Laurie <[email-masked]>
Date: Tue, 08 Jun 1999 19:50:03 +0100

> Because you can't sign with a D-H encryption key, it can only perform

??? If I HMAC then DH the result, isn't that a signature?

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
     - Indira Gandhi

---

From: Stephen Kent <[email-masked]>
Date: Tue, 8 Jun 1999 15:55:54 -0400

Ben,

>??? If I HMAC then DH the result, isn't that a signature?

No, encrypting a hash (I assumed you meant a hash, not HMAC) for
verification by a specified entity (the entity whose public key was an
input to the DH computation you performed) isn't a signature.

Steve

---

From: Ben Laurie <[email-masked]>
Date: Tue, 08 Jun 1999 22:28:50 +0100

Stephen Kent wrote:
> No, encrypting a hash (I assumed you meant a hash, not HMAC)

Sorry, yes, I do, of course.

> for

I encrypt the hash with my private key, of course, not someone else's
public key.

Cheers,

Ben.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 8 Jun 1999 18:01:33 -0400

Ben,
>I encrypt the hash with my private key, of course, not someone else's

NYou don't encrypt anything with a D-H private key or public key.  Use use
your private key and someone else's public key to generate a shared secret
value, which can then be used as a symmetric key for encryption) or as an
input to a symmetric authentication algorithm (e.g., HMAC).

Steve

---

From: Ben Laurie <[email-masked]>
Date: Wed, 09 Jun 1999 12:07:04 +0100

> input to a symmetric authentication algorithm (e.g., HMAC).

Duh. Sorry, I've been thinking too much about blinded DH signatures (a
la Wagner) lately. Of course, the point there is that I check _my own_
"signature" (which I signed blind at some point), not someone else's.

Cheers,

Ben.