Subject: RE: key update - problem

From: Carlisle Adams <[email-masked]>
Date: Tue, 14 Mar 2000 14:39:15 -0500

Hi Martin,

> ----------
> From: 	Martin Szotkowski[SMTP:[email-masked]]
> Sent: 	Tuesday, March 14, 2000 10:42 AM
> To: 	[email-masked]
> Subject: 	key update - problem
> 
> Hi all,
> 
> (excuse me my English)
> I think, that new key must be sign with old key (or in other way POP old
> key) and new key POP must be too present.
> I can't find, how create key update request. In CMP [RFC 2510] and CRMF
> [RFC
> 2511] are defined
> "kur as CertReqMessages; CertReqMsg; CertRequest", but there is no place
> for
> old key.
> Can me someone advise right way.
 
When doing a key update it is not necessary to supply the old public key and
to prove possession of the old private key all over again.  In the request
for a certificate for the new key pair, it is sufficient to put a pointer to
the old certificate that is being updated/replaced.  This is the purpose of
the OldCertId control (see Section 6.5 of RFC 2511).

The key update request needs to contain the new public key and POP for the
new private key, but need not contain anything pertaining to the old
certificate beyond this pointer.

Carlisle.

---

From: "Patrick G. Moore" <[email-masked]>
Date: Tue, 14 Mar 2000 17:23:46 -0500

> certificate beyond this pointer.

Hi Carlisle,

RFC 2510 says to use a secure transport for requests.  I would think, for POP
of an old key, you could put the update request in the body of a signed S/MIME
message, signed with the old cert.  Are there any profiles defined for CMP over
different transports, like S/MIME, http, FTP etc..., which address this issue?
It seems appropriate for key updates, so that an imposter can't request a new
key
for an existing cert.

Pat

---

From: "Martin Szotkowski" <[email-masked]>
Date: Wed, 15 Mar 2000 18:59:51 +0100

Sorry man,
that was my mistake, maybe too much information in few day.
CertReqMessages contain POP for new key pair and PKIMessage contain
PKIProtection for old key sign, isn't it?
Martin