[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

key revocation (was Re: The role of trust in certification)


At 10:55 AM 3/12/98 -0500, Carl Ellison wrote:
>At 04:59 PM 2/13/98 -0500, Bob Blakley wrote:
>>The second and subsequent times I rely on the same certificate, the binding
>>between the CA key and the acceptor key, and the binding between the acceptor
>>key and a signed document, combine to give me confidence (assuming I believe
>>in the strength of cryptography; a whole other discussion) that I'm dealing
>>with the *same* parties with whom I have a past history.  

>What you really count on in this logic is that the person/machine operating 
>the private key is the same in the different instances.  The possession and 
>control of a private key is outside the control of a CA and certainly of a 

To answer myself here (bad habit, but...),

the CA mechanism might give a keyholder an avenue for declaring that
his key was stolen (assume he knows that).  That is, it might provide
the service of key revocation.

Key revocation is achievable with self-signed keys in two ways:

1.	With a self-signed PGP key on the PGP key server, the user can post
	a revocation if the key gets compromised.  This is anti-matter-like,
	however, since the verifier of that key isn't required to check the
	server each time.  This has the drawback that if the private key
	is missing, not just copied, the original user can't issue the

2.	With an SPKI cert, signed by the user's own key, the user can specify
	a limited lifetime so that the cert needs to be re-issued periodically.
	This way, if the private key goes missing, the default is that the
	certificate lifetime ends.  As long as the user has the private key
	and believes it's still his alone, he can issue update certs.  The cert
	would presumably point to where to get a new one (issuer-loc..) or
	to an on-line revalidation location.

 - Carl

Version: PGP for Personal Privacy 5.5.3


|Carl M. Ellison  cme@cybercash.com   http://www.clark.net/pub/cme |
|CyberCash, Inc.                      http://www.cybercash.com/    |
|207 Grindall Street  PGP 08FF BA05 599B 49D2  23C6 6FFD 36BA D342 |
|Baltimore MD 21230-4103  T:(410) 727-4288  F:(410)727-4293        |