Subject: Re: Non-Repudiation

From: [email-masked] (Peter Gutmann)
Date: Sat, 14 Aug 1999 12:37:18 (NZST)

"Dale Gustafson" <[email-masked]> writes:

>Smart card vendors will provide software libraries and card operating systems
>that include support for a "signing only" key pair.  The distinguishing
>characteristic of this special type of public/private key pair is that access
>to the private key component is protected by a special "Signing Key PIN"
>(distinct from the User PIN that controls general user access to the card).
>The Signing Key PIN must be entered each and every time that private key is
>used to create a digital signature (preferably through a protected
>authentication path reader device -- the PIN characters go directly from the
>keyboard or PINpad to the card and do not traverse the user's desktop or
>laptop machine.)

Is there any rigorous definition of exactly what's required for this, or just a
general requirement that a user explicitly take some action to enable the key
for each use?  The way I've implemented this is to allow an extra key attribute
which acts as a usage counter for the object (eg a signature key), after every
use the counter is decremented and once it reaches zero the object destroys
itself.  For the "signing only" use described above, you'd just set the counter
to 1.  This sort of thing would be fairly easy to add onto existing
implementations, for example it could be a new PKCS #11 attribute which can be
set when a key object is created (but not changed afterwards), once you've
implemented it in the PKCS #11 driver you'd automatically have support for it
in any apps which use the driver.

Peter.

---

From: "Dale Gustafson" <[email-masked]>
Date: Mon, 16 Aug 1999 10:06:18 -0500

Peter,

My comments below were intended primarily as an FYI to the list. :-)

It's interesting to note that multiple groups appear to be defining and creating
architectures that require the end user to take some overt action (presumably at a
decision point) during the process of creating a digital signature in support of an
NR service.

Best Regards,

Dale Gustafson

> in any apps which use the driver.

Will provide more info. off-list (e.g., to save bandpass).