Subject: 3280bis: Private Key Usage Period

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 14 Feb 2006 17:20:09 +0100

The text about the private key usage period has been deleted in 3280bis.

During the Paris IETF meeting (August 2005), I advocated the use of the extension for HSMs.

I offer below some text, that can be placed in an annex or in the main body of the document.

Denis

=============================================================

Private Key Usage Period

   The private key usage period extension allows the certificate issuer
   to specify a different validity period for the private key than the
   certificate.  This extension is intended for use with digital
   signature keys.  This extension consists of two optional components,
   notBefore and notAfter.  The private key associated with the
   certificate SHOULD NOT be used to sign objects before or after the
   times specified by the two components, respectively.  CAs conforming
   to this profile MUST NOT generate certificates with private key 
   usage period extensions unless at least one of the two components is
   present and the extension is non-critical.

   CAs conforming to this profile MUST NOT generate certificates that
   include a critical private key usage period extension.

   This extension MAY be used within the Internet PKI, when the 
   private key is protected by a Hardware Security Module (HSM) able 
   to parse the associated public key certificate.  In such a case, 
   the HSM MAY limit the use of the private key to the time period 
   indicated in that extension.

   This extension SHOULD NOT be used within the Internet PKI when 
   the private key usage is not enforceable.

   Where used, notBefore and notAfter are represented as 
   GeneralizedTime and MUST be specified and interpreted as defined 
   in section 4.1.2.5.2.

   id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::=  { id-ce 16 }

   PrivateKeyUsagePeriod ::= SEQUENCE {
        notBefore       [0]     GeneralizedTime OPTIONAL,
        notAfter        [1]     GeneralizedTime OPTIONAL }

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 14 Feb 2006 18:19:06 +0100

- The following sentence is against what was said in Paris as far as I 
rememeber

The discussion in Paris led to the conclusion to remove the first 
sentence of 4.2.1.4
(because there is no justification for it.)

- Furthermore, "enforceable" is a pretty vague term.

- Denis text introduces the usage of HSM as possible use thus making 
others even
more unlikely. I object to the proposed text as normative part, since it 
is  related to
an implementation issue. I wouldn't object adding the HSM related text 
as an example
 of a usage (without an uppercase  MAY)

- At best one could add to the original text: It is totally 
implementation dependent
on how signing entities use or are supposed to use the extension. 

-- 
To verify the signature, see http://edelpki.edelweb.fr/ 
Cela vous permet de charger le certificat de l'autorité; 
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.