Subject: Re: Binding between keys and schemes?

From: "Tolga Acar" <[email-masked]>
Date: Thu, 20 Jan 2000 10:25:57 -0700

There are two relevant OIDs
a. The OID encoded in the subjectPublicKeyInfo, which merely describeds how to interpret the public key in it,
b. the signature OID, that describes which algorithm is used to sign the whole certificate

These two OIDs don't have anything to do with each other - at least not necessarily.
In theory, you can put a custom encoded XYZ algorithm public key, and sign it with ABC algorithm with "a" key.
Following this, one can use a PKCS#1 encoded public key with more than one algorithm, with each algorithm having its own OID - not the key; and i don't see a problem here.
The signature algorithm describes the math and the encoding of the output from the math, not the key. Some of the signature algorithms may require the input key in a certain format - but this relation doesn't have to be bijective.

Thus,

1) a PKCS#1 version x.y encoded public key can be used in N number of different algorithms. And, this does not conflict with the key formatting, i.e., PKCS#1
2) A certificate's signature algorithm can be anything (see RFC ABCD for restrictions), and does not depend on the key format. 

- Tolga

>>> Pedro Félix <[email-masked]> 1/20/00 3:42:48 >>>
1) As defined by PKCS#1 v2.0 an RSA key can be used in two diferent
encryption schemes:
rsaEncryption (PKCS#1 v1.5 scheme) and the new OAEP based scheme
(id-RSAES-OAEP OID).
Is a PKIX certificate with rsaEncryption OID (on the subjectPublicKeyInfo)
binded only to the first scheme?

2) Probably in the future there will be various signature and encryption
schemes using the same type of key. As an example the P1363 draft 11 defines
two signature schemes IFSP-RSA1 and IFSP-RSA2 used with an Encoding method
(EMSA2) that can be updated in the future. They all use the same type of IF
(RSA) key.
How will an certificate manage this 1<->N relation between keys and schemes?
There will be a different certificate for each scheme or the same key
certificate will be used with different schemes?
If the second applies, how will the schemes capabilities of a certificate
subject be identified?

I gave a quick browse on the archives and didn't found any reference to this
subject?

I apologise if this question is off-topic or doesn't make sense in this
context!
I also thanks (in advance) any replies.

Pedro Felix
Centro de Calculo do Instituto Superior de Engenharia de Lisboa.

---

From: Pedro Félix <[email-masked]>
Date: Fri, 21 Jan 2000 10:25:35 -0000

First of all, thanks for your reply.

I apologise for not making my question clear.
When I asked about the binding between a key and a scheme, I was not refering to the scheme used to sign the certificate.

Let's supose that  ALICE, running protocol P, want's to send a PKCS#7 Envelope to BOB, and has a X.509 certificate of BOB's public key (with rsaEncryption OID on the subjectPublicKeyInfo field). The certificate was signed with scheme X (eg. DSA) and was correctly verified by ALICE using that scheme.
Which ENCRYPTION scheme should ALICE use to build the Envelope? ( RSAES-PKCS1-v1_5, RSAES-OAEP , ...)
Probably ALICE would want to use the new RSAES-OAEP, but does BOB support it?
If I understood you correctly, this binding between the key and the scheme IS NOT made by a X.509 certificate (except when the retation is 1-1) and has to be built by other means (possibly defined by the protocol P). I'm I right?

I assume that the source of my initial confusion comes from the fact that, in PKCS#1, the same OID (rsaEncryption) is used to identify both a key and a encryption scheme.

Once again, I thank you for your reply

Best regards

- Pedro Felix

---

From: Jim Schaad <[email-masked]>
Date: Mon, 24 Jan 2000 19:30:54 -0800

My personal opinion on this issue is that in the absense of other knowledge
PKCS1-v1_5 would be used.  If the S/MIME capabilities contained the OID for
OAEP, then it could be used instead.  The certificate does not state which
scheme is to be used (just as it does not state that 3DES or RC5 should be
the bulk encryption algorithm used).
 
jim

-----Original Message-----
From: Pedro Félix [mailto:[email-masked]]
Sent: Friday, January 21, 2000 2:26 AM
To: Tolga Acar; [email-masked]
Subject: Re: Binding between keys and schemes?

When I asked about the binding between a key and a scheme, I was not
refering to the scheme used to sign the certificate.
 
Let's supose that  ALICE, running protocol P, want's to send a PKCS#7
Envelope to BOB, and has a X.509 certificate of BOB's public key (with
rsaEncryption OID on the subjectPublicKeyInfo field). The certificate was
signed with scheme X (eg. DSA) and was correctly verified by ALICE using
that scheme.
Which ENCRYPTION scheme should ALICE use to build the Envelope? (
RSAES-PKCS1-v1_5, RSAES-OAEP , ...)
Probably ALICE would want to use the new RSAES-OAEP, but does BOB support
it?
If I understood you correctly, this binding between the key and the scheme
IS NOT made by a X.509 certificate (except when the retation is 1-1) and has
to be built by other means (possibly defined by the protocol P). I'm I
right?
 
I assume that the source of my initial confusion comes from the fact that,
in PKCS#1, the same OID (rsaEncryption) is used to identify both a key and a
encryption scheme.

Best regards
 
- Pedro Felix