Re: [Cfrg] Keys for multiple cryptographic uses (was: Re: Outline -> was Re: normative references)

[Paul Lambert <[e-mail]>]

Hi Rene,

 ⨳|-----Original Message-----
 ⨳|From: Rene Struik [mailto:[e-mail]]
 ⨳|Sent: Thursday, January 16, 2014 2:31 PM
 ⨳|To: David McGrew; Igoe, Kevin M.; Paul Lambert; Watson Ladd
 ⨳|Cc: Yaron Sheffer; [e-mail]
 ⨳|Subject: Keys for multiple cryptographic uses (was: Re: [Cfrg] Outline
 ⨳|-> was Re: normative references)
 ⨳|
 ⨳|Hi Paul et al:
 ⨳|
 ⨳|A counter example in practice to the "received wisdom" not to reuse
 ⨳|public keys both for key agreement and non-repudiation is during
 ⨳|certification requests, when the key to be certified is to be used for
 ⨳|uses including key agreement and where the request is signed.
 ⨳|
 ⨳|[see also NIST SP 800-56a-2013, Section 5.6.3.2, item #5:
 ⨳|A static key pair may be used in more than one key-establishment
 ⨳|scheme.
 ⨳|However, one static public/private key pair shall not be used for
 ⨳|different purposes (for example, a digital signature key pair is not
 ⨳|to be used for key establishment or vice versa) with the following
 ⨳|possible
 ⨳|exception: when requesting the (initial) certificate for a public
 ⨳|static key-establishment key, the key-establishment private key
 ⨳|associated with the public key may be used to sign the certificate
 ⨳|request. See SP 800-57, Part 1 on Key Usage for further information.
 ⨳|]
 ⨳|
 ⨳|While key separation seems prudent, it is not entirely clear (to me)
 ⨳|whether the conditions under which this is required are precisely
 ⨳|known (even in the above-mentioned case of signed certificate
 ⨳|requests).[ ⨳] 

Yes - exactly!   Caution is good ... but once this guidance was set down we have not bothered to investigate deeply which algorithm combinations are secure for mixed use. 

Additional wisdom on where specific Oracle exist would be very informative.

Thanks,

Paul


 ⨳|
 ⨳|Best regards, Rene
 ⨳|
 ⨳|
 ⨳|On 1/16/2014 3:30 PM, David McGrew wrote:
 ⨳|> Hi Kevin, Paul, and Watson,
 ⨳|>
 ⨳|> On 01/16/2014 02:42 PM, Igoe, Kevin M. wrote:
 ⨳|>> Paul Lambert
 ⨳|>> On Thursday, January 16, 2014 1:43 AM Paul Lambert wrote:
 ⨳|>>
 ⨳|>>> A truly ‘unified' public key system would support both signatures
 ⨳|>>> and key establishment with the same key.
 ⨳|>>>
 ⨳|>> Received wisdom is that using the same key for both key
 ⨳|establishment
 ⨳|>> and signatures is a bad idea.  I believe the concern is that one
 ⨳|>> protocol might be used an Oracle to subvert the other.
 ⨳|>
 ⨳|> Agreed on that point, but there is a background issue here that I
 ⨳|want
 ⨳|> to ask about.
 ⨳|>
 ⨳|> [snip]
 ⨳|
 ⨳|
 ⨳|--
 ⨳|email: [e-mail] | Skype: rstruik
 ⨳|cell: [phone] | US: [phone]