Subject: Why is privateKeyUsagePeriod deprecated?

From: [email-masked] (Peter Gutmann)
Date: Sat, 19 Jul 2003 17:16:02 +1200

PKIX disallows (strongly) this extension, but without giving any reason for
it:

  This extension SHOULD NOT be used within the Internet PKI.  CAs conforming
  to this profile MUST NOT generate certificates that include a critical
  private key usage period extension.

I've now run into several PKI users (including fairly large ones like
government departments and large corporations) who resort to ignoring the cert
expiry date in order to get around this restriction, since they have a
requirement to validate signatures long after use of the private key has been
discontinued.  Is there any reason for this extension being disallowed (I'm
sure I've asked that before, but don't remember getting a satisfactory reply)?
What are you supposed to do in its absence?

Peter.

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 21 Jul 2003 11:03:02 -0400

>What are you supposed to do in its absence?
Peter,

It is my understanding that use of this extension was deprecated since, 
unless signed messages are timestamped by a trusted time stamping 
service, there is no way of determining when a message was signed.  
Without this ability, the relying party can not verify that the 
signature was created before the end of the private key usage period, if 
the signature is being verified after the end of the private key usage 
period.  If relying parties can not make use of the information, then 
there is no reason to include it in the certificate.

Of course, there is no reason that one can not discontinue use of a 
private key before the expiration of the corresponding certificate even 
if there is no indication in the certificate of when use of the private 
key is supposed to end.  Is there any reason that the PKI users you 
mention need to include this information in the certificate?  If there 
is a need to verify signatures for up to 7 years after the signature was 
generated, why not just institute a policy that all subscribers must 
rekey 7 years before the expiration of their certificates?  Why does the 
private key usage period need to be specified in the certificate (except 
perhaps indirectly by mentioning it in the certificate policy)?

Dave

---

From: David Chadwick <[email-masked]>
Date: Mon, 21 Jul 2003 18:29:09 +0100

> >requirement to validate signatures long after use of the private key has been

Peter

the original idea in X.509 was to allow a certificate expiry date to be
significantly after the private key usage period to allow for signature
verification long after signatures could no longer be created. thus both
times are useful.

David Cooper wrote

> service, there is no way of determining when a message was signed.

this is obviously not true. If I recieve a signed message BEFORE the
private key usage period has expired, I KNOW that the signature is time
valid. I dont need a TSA to tell me that. I can read my watch. I can
then add my own time stamp and signature and stick it in my archives, if
I am so concerned about time.

> there is no reason to include it in the certificate.

This is a illogical leap that has been taken. Just because there is a
very small time period during which a signer can validly use his private
signing key, but the RP cannot receive it and validate it before the
private key usage period expires, is no reason to state that the RP can
not make use of the information. If 1% (or less) of the time is
unusable, it is no reason to discard 99% of the time (or more) that is
usuable. Anyhow, any good PKI would have replaced the user's signing key
long before the private key usage period had expired. 

> rekey 7 years before the expiration of their certificates? 

This is a good point, and a work around for not using the private key
usage period. But like all policy, we can not record it in the cert, or
we can record it in the cert. The tendency with X.509 has been to record
as much of the policy as possible and that is automatically checkable in
the cert. So this argues for keeping and using the private key usage
period

David

> Why does the

-- 
*********************************************************

Leaders of the world's richest nations meet in Cancun on September 10th
2003. Oxfam is presenting them with a petition to make trade fair. Be
sure your voice is heard. Sign the 'Big Noise' petition to make trade
fair at:

http://www.maketradefair.com/go/join/?p=omf1 

*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 01484 532930
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Web site: http://sec.isi.salford.ac.uk
Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************

---

From: Stephen Kent <[email-masked]>
Date: Tue, 22 Jul 2003 08:07:58 -0400

David,

>verification long after signatures could no longer be created. thus both

I don't think one can say that this was the "original" idea, since v1 
and v2 certs didn't have PKUP.  Rather, PKUP is an extension that was 
created to allow certs used in support of NR to be validated after 
the period for private key use had expired.  I don't think there is 
any use for PKUP in contexts where we are dealing with certs for 
authentication, vs. NR.

>I am so concerned about time.

I don't think this is a generally applicable example. In general you 
will receive the message in a time frame consistent with the notAfter 
date in the cert, and can make the value judgement you cite above 
(based on your watch) about whether the cert expired so long ago that 
the message should be regarde with suspicion, or not.

>long before the private key usage period had expired.

I don't understand your argument at all. If we ignore PKUP for the 
moment, then I think the numbers are reversed, i.e., 99% of the time 
an RP will receive a cert and find that the current time is within 
the validity interval. I think the typical case for PKUP arises when 
we are validating a cert path to establish whether a  signature was 
valid in some past time frame that is significabtly removed from the 
current time, e.g., months or years later.

>the cert. So this argues for keeping and using the private key usage

I was not an author for 2459 or 3280, but my feeling is that we do 
not recommend use of PKUP for several reasons:

	- it is generally confusing to folks who already have trouble 
understanding PKI

	- only in the context of post facto evaluation for NR 
purposes is it likely to be applicable

	- it embodies the notion that we can declare that a signature 
generated with a private key expires at a future date, relative to NR 
concerns. this is not a good match for many real world contexts on 
which NR is an issue, e.g., my wet signature does not expire although 
an agreement may have a limited lifespan.

Steve

---

From: "Dean Adams" <[email-masked]>
Date: Tue, 22 Jul 2003 16:22:28 +0100

Hi,
I strongly agree with Steven's comments made above and for those reasons
would agree with deprecating privateKeyUsagePeriod.  A simpler scheme, if
one agrees with the last point that Steven made, would be to acknowledge
that the private key may be used by the subscriber up to the end of the
certificate validity for signing authenticating etc., but that Relying
Parties may continue to validate signatures for an indefinite period after
that period (whether or not that later validation can be used to support a
position or claim can only be answered by whatever governing
legal/regulatory/policy/TermsAndConditions fremework is in force.  Thus only
one validity or usage period need be specified and understood by users.

	Dean Adams

Steven Kent wrote:
--------------

Steve
---------------