Subject: Confusion with regards to "thisMessage" POP

From: "Christopher Williams" <[email-masked]>
Date: Thu, 30 Mar 2000 10:04:31 +0100

There is still some ambiguity as to establishment in "thisMessage" of POP
for an encryption key.

draft-ietf-pkix-rfc2510bis says in section 3.2.8 that POP can be
established:
"By the inclusion of the private key (encrypted) in the
CertRequest (in the PKIArchiveOptions control structure)."

However, in Appendix D, we then have:

"-- **********
-- * the type of "thisMessage" was mistakenly given as BIT STRING in
-- * RFC 2511; it should have been "EncryptedValue" (in accordance with
-- * Section 3.2.2 of this specification).  Therefore, this document makes
-- * the behavioral clarification of specifying that the contents of
-- * "thisMessage" MUST be encoded as an EncryptedValue and then wrapped
-- * in a BIT STRING.  This allows the necessary conveyance and protection
-- * of the private key while maintaining bits-on-the-wire compatibility
-- * with RFC 2511.
-- **********"

I'm guessing that the latter is how the authors now envision POP of a
private key as this is a recent addition to the standard; however, the
PKIArchiveOptions control is the structure specifically designed for sending
a private key to a CA.  Which is correct?

Chris Williams,
NetLexis

---

From: Carlisle Adams <[email-masked]>
Date: Thu, 30 Mar 2000 10:27:19 -0500

Hi Chris,

> ----------
> From: 	Christopher Williams[SMTP:[email-masked]]
> Sent: 	Thursday, March 30, 2000 4:04 AM
> To: 	[email-masked]
> Subject: 	Confusion with regards to "thisMessage" POP
> 
 
This is not meant to be confusing.  Proof-of-possession and archive are two
different things:  the former is simply a proof to the CA that I, in fact,
hold the private key corresponding to the public key I'm asking to get
certified; the latter asks the CA (or associated facility) to hold a copy of
my private key so that this key can be recovered later if I lose it or it
otherwise becomes inaccessible.

As it turns out, ONE of the ways (not necessarily the most desirable way) of
proving possession is to actually reveal the private key to the CA.  In
general, it's probably advisable to avoid this method unless the EE also
wants the private key archived, but if the CA is trusted not to abuse its
knowledge of a private key revealed only for POP purposes, then an EE is
free to do this if it desires.

In any case, POP and archive are different functions that serve different
purposes; they just happen to overlap in one optional mechanism (i.e.,
revealing the private key for POP).  Therefore the question "Which is
correct?" does not apply.

Carlisle.