Subject: RE: Making more of Key IDs (was RE: 3280 Question WRT SKID/AKID matching)

From: "Ryan M. Hurst" <[email-masked]>
Date: Wed, 27 Aug 2003 15:22:43 -0700

As a point of reference CryptoAPI (and as a result Windows) performs key
based chaining and only falls back to name based chaining if AKIs are
not available.

Ryan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Terwilliger, Ann
Sent: Wednesday, August 27, 2003 11:26 AM
To: [email-masked]
Subject: RE: Making more of Key IDs (was RE: 3280 Question WRT SKID/AKID
matching)

I agree that trust path construction should be done with DNs rather than
Key Ids.  However, on occasion we have needed to have more than one CA
certificate with the exact same DN in our private hierarchy.  In that
case, trust path construction requires that there be a way to ensure
that we have the correct certificates to validate the signatures in the
chain.  In general we either use the key ids (AKID/SKID) or (gasp) the
other parameters included in the AKI extension--authorityCertIssuer and
authorityCertSerialNumber.  

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Friday, August 22, 2003 7:59 AM
Cc: [email-masked]
Subject: Making more of Key IDs (was RE: 3280 Question WRT SKID/AKID
matching)

Donning flameproof underpants for this one.

Trust path construction should be done with Distinguished Names
rather than Key IDs but I feel that, with a bit of work, Key IDs could
be made into a reliable mechanism and one that would permit
local trust path construction in the continuing absence of a public
global
directory. It requires that the Key IDs can only be generated at the
same
time as, and by the same device as, the keys themselves. RFC3280 states
that a Key ID need only be generated if there is not one already present
and merely copied when present. Employing this method would mask out
local differences in the interpretations of Key ID algorithms. If the
value
of the keys can be relied on then so can the trust paths that can be
built
using them.

Toast ?

Chris