Subject: RE: 3280bis: private key usage extension (2)

From: "Stefan Santesson" <[email-masked]>
Date: Fri, 17 Feb 2006 00:37:11 -0000

Non-critical does not mean that it can be ignored at will.
Non-critical means that you can still use the certificate even if you
don't recognize it.

Your definition is different from the one in X.509, which states that
this extension "indicates" a limitation on the usage period that is
enforced on the private key in the signing environment.

This indicates enforcement of local policy in the signing environment
that typically is beyond the CA to vouch for.

I would like to se a distinct use case that the WG can evaluate.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas
Sent: den 16 februari 2006 07:21
To: pkix
Subject: 3280bis: private key usage extension (2)

Copy of the minutes from the Paris PKIX meeting:

"He [Denis] suggested that the private key usage extension not be
deprecated universally, 
but rather be allowed in certain contexts, e.g., time stamp crypto
modules. 
He proposed to soften the prohibition against private key usage or to
delete annex D.1. 
and thus annex D) which is the only section that addresses this topic".

Peter correctly recalls that there was no objection raised on that issue
by the participants 
of the Paris meeting.

Stefan's argumentation is that it should not be part of the profile. 
There are many features described in the document that MAY be
implemented 
but are not mandatory to implement. I see advantages to describe the
extension within this profile.

I believe however that an additional clarification is needed. The
private key usage extension 
is only intended to be used by the owner of the certificate. For this I
added: " by the certificate owner". 
This extension can fully be ignored by the other "relying parties", this
is why this extension is non-critical. 
For this I added: "Except the certificate owner, other relying parties
SHOULD ignore that extension".

However, it can be very useful for (HSM Hardware Security Modules) when
the properties of the HSM 
can be verified : this allows an enforcement by the CA the private key
will not be used beyond 
a given date. Since the end of the use of the private key, if specified,
will be shorter than the end of the 
validity period of the certificate, this allows to guaranty a minimum
period during which 
the signed object can be verified (e.g. PKCs or TSTs).

Proposed revised text:

Private Key Usage Period

   The private key usage period extension allows the certificate issuer
   to specify a different validity period for the private key than the
   certificate.  This extension is intended for use with digital
   signature keys.  This extension consists of two optional components,
   notBefore and notAfter.  The private key associated with the
   certificate SHOULD NOT be used by the certificate owner to sign 
   objects before or after the times specified by the two components, 
   respectively.  CAs conforming to this profile MUST NOT generate 
   certificates with private key usage period extensions unless at 
   least one of the two components is present and the extension is 
   non-critical.

   CAs conforming to this profile MUST NOT generate certificates that
   include a critical private key usage period extension.

   Except the certificate owner, other relying parties SHOULD ignore 
   that extension.

   This extension MAY be used within the Internet PKI, when the 
   private key is protected by a Hardware Security Module (HSM) able 
   to parse the associated public key certificate.  In such a case, 
   the HSM MAY limit the use of the private key to the time period 
   indicated in that extension.

   Where used, notBefore and notAfter are represented as 
   GeneralizedTime and MUST be specified and interpreted as defined 
   in section 4.1.2.5.2.

   id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::=  { id-ce 16 }

   PrivateKeyUsagePeriod ::= SEQUENCE {
        notBefore       [0]     GeneralizedTime OPTIONAL,
        notAfter        [1]     GeneralizedTime OPTIONAL }

Denis