Subject: Re: Certificate requests for encryption keys

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 09 Jun 1999 08:10:17 -0600

This thread has engendered several interesting subthreads, but let's dispatch
the first one, first.

As Steve says, the fundamental principle behind requiring Proof of Possession
with respect to the private key of a key pair is to assure that the user
who is identified in the certificate containing that the public key does
in fact possess the private key, and isn't trying to spoof someone somehow.

In the case of a digital signature, not requiring proof of possession would
allow me to get of copy of Thomas Edison's public key (small time wrap
problem omitted for brevity) and claim all of his digitally signed patents
as my own.  (Assuming he didn't actually include his name
in the patent itself, of course.)

What kind of mischief could someone carry out with an encryption key
without POP? 

Well, maybe I somehow intercept Steve's encryption certificate request
and substitute my own public key in it.  Steve's identity is valid --- he's 
a good guy -- so the certificate would be issued.  Now people 
blurt out their innermost secrets to him, and he can't read them but I
can.

Not very convincing, as I suspect was Brian's point, but my inability
to find a rally zinger of a threat probably means that I'm not thinking hard 
enough, rather than indicating there is no threat.

The obvious was to do POP for encryption keys is for the CA to encrypt a 
challenge, send it to the Subscriber, and have him send back the decrypted
result.  The problem is that is rather awkward from the standpoint of most
certificate request protocols.

Bob

>>> Stephen Kent <[email-masked]> 06/08/99 01:47PM >>>
Anne,

Certs with keys used only for encryption, vs. signing, are still bound to
an identity in the X.509 world.  For exmaple, in S/MIME, one uses such a
key to encrypt a message (more precisely the CEK for the message) for a
specified recipient.  Thus, the sender relies on a CA to have verified the
subject name in that encryption-only cert.  So, I don't think your
characterization of when identity verification is important in signature
vs. encryption certs is a good one.

Steve

---

From: Terry Hayes <[email-masked]>
Date: Wed, 09 Jun 1999 08:58:12 -0700

I'll have to disagree with most of this - I haven't seen a compelling argument
for Proof of Possession yet.  To my mind it is a large amount of added complexity
(for PKI protocols) without any real benefit.  I've responded to Bob's examples
below (I thank him for the examples, if anyone has better ones I'd like to see
them)

> in fact possess the private key, and isn't trying to spoof someone somehow.

And how does the user "spoof" someone when they don't have the private key that
corresponds to the public key in the certificate?  To my way of thinking this
certificate is worthless, since the user can't exercise any of the privileges (if
any) that it would allow the key holder.

> in the patent itself, of course.)

This example relies on the assumption that simply signing a piece of data somehow
transfers ownership of it to the signer.  It's my understanding that signing
simply indicates that the signer saw the data, and sometimes has agreed to the
meaning of its contents.  It is also important to get some kind of time stamp on
data (such as a patent submission) to prove its existence prior to a certain
time.  In other words, simply signing is not very interesting in this case.

Even if the CA is doing POP, I can simply request my own certificate from the CA
and sign the same message as Thomas did with my own key.  Now it belongs to me,
right?  Of course not.  There are two ways to prevent this: 1) time stamp the
resulting signature and 2) put your name in the document.

In general, I think most requests for POP are the result of protocols that aren't
designed properly.  If you leave your name out of the patent document, then some
user could attempt to steal it.  I'm in favor of fixing the protocol, not adding
a POP mechanism to the PKI structure.

Protocols that use signatures should "sign what they mean" - in this example the
name of the inventor of the new technology is an very important part of the
document.  It should not be inferred simply from the signature on the document.

> blurt out their innermost secrets to him, and he can't read them but I

This is a failing in the certificate request protocol, not an argument for POP.
If the CA that you deal with issues certificates with public keys that are not
properly authenticated, then either the certificate request protocol is broken or
the CA isn't doing its job and shouldn't be trusted.

> enough, rather than indicating there is no threat.

I don't agree.  I think this is a technology looking for a threat - and having a
hard time finding it.

> certificate request protocols.

Yes, this is the most straight-forward way, and is awkward.  The currently
proposed POP protocols (that tie in to requested identity) are fine, but I still
argue that they are not needed.  Fix the operational level protocols instead.

Terry

---

From: Michael Sierchio <[email-masked]>
Date: Wed, 09 Jun 1999 09:37:44 -0700

> What kind of mischief could someone carry out with an encryption key

I think you're engaging in intentional fallacy --

Anne's scenario includes:

	1)	an EE signing cert,  with identity attested to by appropriate
		RA, CA and the Pope, perhaps restricted in use to signing 
		encyption-only certs with half-life in seconds;

	2)	a signature over a (possibly ephemeral EE encryption cert),
		attesting to its validity, by the EE;

	3)	ability to perform encryption after (2) is proof of possession of the
		private key;

	4)	ability to sign this cert with (1) is proof of identity.

If I were to sign a message stating "for the next two hours,  I will use
the following DH parameters for communication with Anne..." it would be
equivalent.  The difference is the ability to cook an X.509 cert which
would permit key discovery through "normal" means,  quite convenient.

A self-signed cert contained in a message signed by my signing key is also
somewhat equivalent.  I like Anne's approach better.

Cheers,

Michael Sierchio

---

From: Al Arsenault <[email-masked]>
Date: Wed, 09 Jun 1999 14:30:30 -0400

Here we go 'round the mulberry bush, the mulberry bush, the mulberry bush;
here we go 'round the mulberry bush, so early in the morning....

Since this discussion has taken place at least 5 times now on this mailing list, I
will once again suggest that all parties interested in Proof of Possession theology
review Section 5.2 of the PKIX Roadmap I-D.  Comments are appreciated.

You might also want to take a look at the PKIX Archive (found at www.imc.org) for the
last discussion of this, which occurred in January and February of this year.

                Al Arsenault

-- Speaking only for myself.  My opinions do not necessarily reflect those of my
employer or of any other organization with which I have a relationship.