Subject: Re: Certificate requests for encryption keys

From: [email-masked] (Peter Gutmann)
Date: Thu, 10 Jun 1999 07:14:30 (NZST)

Stephen Kent <[email-masked]> writes:

>Your characterization of what you are trying to do is somewhat ncomplete, 
>I suspect.  You don't want to just transfer a public key; you want to
>transfer it with some set of assurances, e.g., so that the recipient knows
>whose public key it is.

I already have those assurances:

- If it's a raw key, it'll be transferred via a trusted channel (eg I hand you
  a disk with my key on it, or send it via a sealed courier bag which in many
  jurisdictions meets the legal requirements for secure, authenticated
  transport[0]).
- If it's an encryption key signed with my signature key, you can trace
  the trust via my signature key.

>Along those lines, maybe you should make use of some other syntax if your
>goals for public key representation for transfer are not congurent with
>those stated here.  We can't be everything to everyone.  One size rarely
>fits all.

X.509, appropriately profiled, can do this.  The problem with the DIY
approach is that there are already dozens of incompatible and underdocumented
attempts at this, none of which are useful if you want to use software from
more than one vendor.  By profiling it properly, you have a standard,
recognised, interoperable way of doing what people are currently doing via
all sorts of hacks and kludges (I think I've mentioned before the number of
self-signed EE/sort-of-CA certs I've run across which are being used because 
there's no other way to do this).  People are doing it anyway (regardless of 
what X.509 theology has to say about it), so we may as well define a way to do
it in a standised manner.

Paul Hoffman / IMC <[email-masked]> added:

>I'll disagree with your characterization of what Peter has asked for. There
>are many good reasons to want to use the *format* described in PKIX for
>transporting public keys without being forced to use the systems associated
>with PKIX to process the certificates. Peter is (I believe) saying "I'll do
>the assurances out of band, just let me use your format".

That's exactly it.

Peter.

[0] In NZ, which along with many other countries currently has no digital 
    signature legislation, if you want the use of digitally signed documents 
    to stand up in court, this is the safest way to handle public key 
    distribution - sealed courier envelopes have legal recognition whereas 
    CA's are just a cute academic exercise for which noone, including the 
    government (thus the lack of legislation) wants to be the test case.  It'd
    be nice to use a CA and there are pilot projects which are actually doing 
    this, but the last time I talked to corporate lawyers their advice, after 
    much analysis of the situation, was to go with the more traditional way of 
    doing things until someone passed the appropriate legislation.

---

From: Paul Koning <[email-masked]>
Date: Wed, 9 Jun 1999 16:42:55 -0400

I may be missing something here...

If the issue is that you need a PKI that includes support for
self-signed EE certificates, that it also standardized and supported
by IKE, how about using PGP keys?  It seems that these have the
required properties.

	paul