Subject: Controls over signing keys (Was: Re; Non-repudiation)

From: "Bob Jueneman" <[email-masked]>
Date: Mon, 16 Aug 1999 10:04:45 -0600

Dale, in addition to supporting smart cards, we are also very interested in supporting
high-integrity software-only solutions that supporting signing and even nonrepudiation.
Understanding a set of requirements that would pertain to both hardware and software
via a PKCS #11 interface would be extremely useful.

So I encourage you (and Peter) to continue to post whatever comments you might 
have in this area to the entire group.  

Bob

> "Dale Gustafson" <[email-masked]> writes:
>
> >Smart card vendors will provide software libraries and card operating systems
> >that include support for a "signing only" key pair.  The distinguishing
> >characteristic of this special type of public/private key pair is that access
> >to the private key component is protected by a special "Signing Key PIN"
> >(distinct from the User PIN that controls general user access to the card).
> >The Signing Key PIN must be entered each and every time that private key is
> >used to create a digital signature (preferably through a protected
> >authentication path reader device -- the PIN characters go directly from the
> >keyboard or PINpad to the card and do not traverse the user's desktop or
> >laptop machine.)
>
> Is there any rigorous definition of exactly what's required for this, or just a
> general requirement that a user explicitly take some action to enable the key
> for each use?  The way I've implemented this is to allow an extra key attribute
> which acts as a usage counter for the object (eg a signature key), after every
> use the counter is decremented and once it reaches zero the object destroys
> itself.  For the "signing only" use described above, you'd just set the counter
> to 1.  This sort of thing would be fairly easy to add onto existing
> implementations, for example it could be a new PKCS #11 attribute which can be
> set when a key object is created (but not changed afterwards), once you've
> implemented it in the PKCS #11 driver you'd automatically have support for it
> in any apps which use the driver.

Will provide more info. off-list (e.g., to save bandpass).

> Peter.