Subject: Re: Why is privateKeyUsagePeriod deprecated?

From: [email-masked] (Peter Gutmann)
Date: Tue, 22 Jul 2003 23:12:20 +1200

David Chadwick <[email-masked]> writes:

>the original idea in X.509 was to allow a certificate expiry date to be
>significantly after the private key usage period to allow for signature
>verification long after signatures could no longer be created. thus both
>times are useful.

Right, and I think that's a most useful thing to have and have been... well,
maybe not encouraging people to use it but certainly letting them know that
it's there if they need it.  The problem is that because of the wording in
2459/3280, users are scared off using it, so if a very useful feature like
PKUP is deprecated then there should be some good reason for it.  If there's
no reason, and obviously there's user demand for having it (and the
alternative that is being used, ignoring cert expiry dates, is horrible) then
the current SHOULD NOT should really be changed to SHOULD, or at least
removed.

Could it be that the perceived problems with PKUP is that it works in reverse?
That is, the validity says the cert is valid for time X, and then PKUP comes
along and says that in some cases it isn't, when what you really need is two
validities, one which indicates the period over which the cert can be used in
general and the second which says that after the main validity expires it can
still be used in a limited manner.  Obviously for signing certs the main
validity would be "sign + verify", and then the restricted-validity would be
"verify-only", a bit like time-limited trials of software.

>The tendency with X.509 has been to record as much of the policy as possible
>and that is automatically checkable in the cert. So this argues for keeping
>and using the private key usage period

Exactly.  If you've got different validity periods for the public and private
portions of the key, then you really need to state it in the cert, even if
only as an expression of CA policy on the topic.

Peter.

---

From: "Gregory S. Chudov" <[email-masked]>
Date: Tue, 22 Jul 2003 18:43:24 +0400

Greetings.

David Cooper wrote
> It is my understanding that use of this extension was deprecated since,
> unless signed messages are timestamped by a trusted time stamping
> service, there is no way of determining when a message was signed.
Yes, it is true, this extension does not help validating signatures.
But it has a different meaning. It expresses the policy, under which this
key
is used.

> only as an expression of CA policy on the topic.
Agree. And it's not only an expression of CA policy, this also
gives clients a way to verify that CA (or any other authority)
really follows it's own policy.

For example, Russian cryptographic practice dictates that
the private key MUST be destroyed before it expires.
If it is not destroyed, than it's considered compromised,
and the corresponding certificate should be revoked.
It's sad, that PKIXCMP doesn't define a key destruction announce message.
But of course, there's that GeneralMessage, that can be used for that...

So, privateKeyUsage states:
"I promise to destroy my key before given time. If i don't, consider it
compromized."
And the peer can verify this, e.g. by fetching key destruction announces, or
using some out-of-band mechanism.

Good luck,
Greg Chudov