Subject: key uniqueness in a PKI

From: "Miguel Rodriguez" <[email-masked]>
Date: Wed, 7 Apr 2004 10:39:40 -0500

Where can I find information on key pair uniqueness in a PKI? Is this
issue discussed in an RFC?
I will also appreciate comments on this issue, particularly when
considering a PKI with several CAs.
 
Thanks.
 
Miguel A Rodriguez
SeguriData
Mexico

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Apr 2004 16:39:48 -0400

At 10:39 AM -0500 4/7/04, Miguel Rodriguez wrote:
>Where can I find information on key pair uniqueness in a PKI? Is 
>this issue discussed in an RFC?

there is no standards-based requirement that a CA verify that each 
cert request contain a unique public key, neither globally nor 
relative to the certs that the CA has perviously issued.  A CA might 
choose to try to make checks relative to the certs it has issued, and 
for which it still has this info, but there is no requirement to do 
so in X.509 nor PKIX standards.

Steve

---

From: "Bill Burns" <[email-masked]>
Date: Wed, 7 Apr 2004 17:42:50 -0700 (PDT)

Stephen
Kent wrote on 4/7/04, 1:39 PM:

At 10:39 AM -0500
4/7/04, Miguel Rodriguez wrote:

Where
can I
find information on key pair uniqueness in a PKI? Is this issue
discussed in an RFC?

I will
also
appreciate comments on this issue, particularly when considering a PKI
with several CAs.

Thanks.

Miguel A
Rodriguez

SeguriData

Mexico

there is no
standards-based requirement that a CA verify that
each cert request contain a unique public key, neither globally nor
relative to the certs that the CA has perviously issued.  A CA
might choose to try to make checks relative to the certs it has
issued, and for which it still has this info, but there is no
requirement to do so in X.509 nor PKIX standards.

Steve

FWIW,
there's also a
mention of this in the WebTrust for CA's documentation.  It's not a
"requirement" per se, but they seem to suggest that it's a good idea.
Nevertheless, that's a pretty expensive operation to
perform...especially as the Member base grows.

bill

---

From: "Miguel Rodriguez" <[email-masked]>
Date: Thu, 15 Apr 2004 12:38:21 -0500

Thanks to both Steve and Bill. Now for a more technical question: how
bad is not to check for key uniqueness? does anyone know about problems
arising from this situation?
 
Thanks in advance,
 
Miguel Rodriguez

-----Original Message-----
From: Bill Burns [mailto:[email-masked]] 
Sent: Wednesday, April 07, 2004 7:43 PM
To: Stephen Kent
Cc: Miguel Rodriguez; [email-masked]
Subject: Re: key uniqueness in a PKI

Stephen Kent wrote on 4/7/04, 1:39 PM: 

 

Thanks.

Miguel A Rodriguez

SeguriData

Mexico

there is no standards-based requirement that a CA verify that each cert
request contain a unique public key, neither globally nor relative to
the certs that the CA has perviously issued.  A CA might choose to try
to make checks relative to the certs it has issued, and for which it
still has this info, but there is no requirement to do so in X.509 nor
PKIX standards.

Steve

FWIW, there's also a mention of this in the WebTrust for CA's
documentation.  It's not a "requirement" per se, but they seem to
suggest that it's a good idea.  Nevertheless, that's a pretty expensive
operation to perform...especially as the Member base grows.

bill