Subject: Re: Server-signatures: Re: proposed key usaged text -- the final round

From: Tim Polk <[email-masked]>
Date: Wed, 01 Dec 1999 11:18:39 -0500

Anders,

Actually, the text below was from the Security Considerations text in RFC
2459.    

At 04:58 AM 12/01/1999 -0000, Anders Rundgren wrote:

>Tony,

>I may be wrong but I assumed that the text below was to be included in
the NR-document

>and if so is the case it talks about things like "users" and "personal
information" which

>is not coherent with server-generated signatures.

>>>    >The protection afforded private keys is a critical factor in
main-

>>>    >taining security. On a small scale, failure of users to protect

>>>    >their private keys will permit an attacker to masquerade as them,
or

>>>    >decrypt their personal information. [stuff about CA keys
deleted]

> [stuff deleted]

Here is the full paragraph from RFC 2459.

<bigger>   The protection afforded private keys is a critical factor in

   maintaining security.  On a small scale, failure of users to protect

   their private keys will permit an attacker to masquerade as them, or

   decrypt their personal information. On a larger scale, compromise of

   a CA's private signing key may have a catastrophic effect.  If an

   attacker obtains the private key unnoticed, the attacker may issue

   bogus certificates and CRLs.  Existence of bogus certificates and

   CRLs will undermine confidence in the system. If the compromise is

   detected, all certificates issued to the CA shall be revoked,

   preventing services between its users and users of other CAs.

   Rebuilding after such a compromise will be problematic, so CAs are

   advised to implement a combination of strong technical measures

   (e.g., tamper-resistant cryptographic modules) and appropriate

   management procedures (e.g., separation of duties) to avoid such an

   incident.

</bigger>Yes, things are slightly different if the key represents a
corporate identity (instead of a person), but not much.  Compromise still
permits an attacker to masquerade, but as a corporate entity instead of
as a person.

In my opinion, the security considerations text can ignore these
differences.  The NR document, on the other hand, may need to address
those subtleties.

Thanks,

Tim Polk

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 01 Dec 1999 10:41:15 -0800

At 04:58 AM 12/01/1999 -0000, Anders Rundgren wrote:
>Tony,
>I may be wrong but I assumed that the text below was to be included in the NR-document
>and if so is the case it talks about things like "users" and "personal information" which
>>>    >The protection afforded private keys is a critical factor in main-
>>>    >decrypt their personal information. [stuff about CA keys deleted]

OK, I agree.  There is no particular reason to assume that a "private
signing key" is held by an "individual" (human) or necessarily controls
access to human-related information.  Perhaps the above paragraph could
be reworded:

   The protection afforded private keys is a critical factor in maintaining
   security.  Failure to protect the privacy of private signing keys may
   permit an attacker to masquerade as the key's owner or authorized agent.
   The consequences of private key compromise may include loss of privacy or
   integrity in key-controlled transactions.  

I intentionally dropped the qualifier "On a small scale".  I did not
understand its justification.  Perhaps the original author(s) have a
low expectation for the future ubiquity of key-controlled transactions.

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 01 Dec 1999 11:01:33 -0800

At 11:18 AM 12/01/1999 -0500, Tim Polk wrote:

<excerpt>Here is the full paragraph from RFC 2459.

   incident.

</bigger></excerpt>

Tim,

Thanks.  It helped to have the full paragraph.  It now comes across as

speaking to potential CAs more than to EEs.  Compromise of CA signing

keys is certainly catastrophic!

___tony___

<excerpt>Yes, things are slightly different if the key represents a
corporate identity (instead of a person), but not much.  Compromise still
permits an attacker to masquerade, but as a corporate entity instead of
as a person.

Thanks,

Tim Polk

</excerpt><<<<<<<<

Tony Bartoletti                                             LL

IOWA Center                                              LL LL