Subject: RE: Re: Why is privateKeyUsagePeriod deprecated?

From: "bonny joy" <[email-masked]>
Date: Mon, 28 Jul 2003 00:20:48 +0000

Dear Steve

The PKUP does operate as you note, but the cert validity period is still 
present, and in the presence of the PKUP extension, this field is 
reinterpreted to state that after the notAfter date, the cert may no longer 
be used to verify any signature, period.  That too is part of the reason for 
not encouraging use of PKUP, i.e., the need to reinterpret the cert validity 
field.

This is my view

The certificate can be used to verify the signature during the certificate 
validity period irrespective of the PKUP  , for this reason certificate 
validity period should be present

The signature should not be generated after or before  the PKUP, since the 
private key validity period is different from the certificate validity 
period , this field should be present

So why does a certificate processing part should get confused by seeing the 
2 fields , those 2 fields are meant for different purposes, First check the 
signature has been created at the valid period ,then check the validity of 
the certificate. In the case of NR the validity of the certificate is not 
having any impact ,since the thrust is on PKUP.

Regards Bonny

_________________________________________________________________
They are beautiful. They are in danger. 
http://server1.msn.co.in/Slideshow/BeautyoftheBeast/index.asp Our 
four-legged friends.

---

From: <[email-masked]>
Date: Mon, 28 Jul 2003 11:25:01 +0200

> not encouraging use of PKUP, i.e., the need to reinterpret the cert
validity 

From my point of view, PKUP could be an useful extention of CA certs. 
CA must issue its new cert long time before expiration of its own 
certificate (this period is min of max of the time validity of issued EE
certs).

It means: After issuing new CA cert (new-new) the old CA cert (old-old) 
is still valid but an appropriate old private key of the CA is not used 
henceforth. This private key should be authoritative erased when 
the new certificate CA is issued. Lifetime of private key is shorter
than 
the validity period of the certificate. This lifetime of private key 
could be indicated in PKUP.

Today, the lifetime of private key is  indicated in the certificate 
policy (CP). Unfortunately it is not possible to  start procedure 
for downloading new CA certs (old-new, new-new and new-old)
automatically
because the certificate policy (CP) is a nonstructured text. In
practice, 
the lifetime of CA private key is not even  published in CP yet. It is 
published in CPS (RFC-2527) which is not in case of the majority 
of  CAs public. Therefore it might by useful to indicate  this 
information in the PKUP.

Libor Dostalek

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 30 Jul 2003 11:07:25 +0200

Libor,

(...)

Yes. PKUP could be a useful extension for self-signed certificates, *if* the 
Subject Information Access extension defined in section 4.2.2.2 from RFC 
3280 is also used. In that case, the id-ad-caRepository OID SHALL be used to 
indicate in which repository the CA publishes its certificates.

Denis

> than the validity period of the certificate. This lifetime of private 
 > key could be indicated in PKUP.

> automatically because the certificate policy (CP) is a nonstructured
 > text. In practice, the lifetime of CA private key is not even
 > published in CP yet. It is published in CPS (RFC-2527) which is not
 > in case of the majority of CAs public. Therefore it might by useful
 > to indicate this information in the PKUP.