[Cfrg] Keys for multiple cryptographic uses (was: Re: Outline -> was Re: normative references)

[Rene Struik <[e-mail]>]

Hi Paul et al:

A counter example in practice to the "received wisdom" not to reuse 
public keys both for key agreement and non-repudiation is during 
certification requests, when the key to be certified is to be used for 
uses including key agreement and where the request is signed.

[see also NIST SP 800-56a-2013, Section 5.6.3.2, item #5:
A static key pair may be used in more than one key-establishment scheme. 
However, one static public/private key pair shall not be used for 
different purposes (for example, a digital signature key pair is not to 
be used for key establishment or vice versa) with the following possible 
exception: when requesting the (initial) certificate for a public static 
key-establishment key, the key-establishment private key associated with 
the public key may be used to sign the certificate request. See SP 
800-57, Part 1 on Key Usage for further information.
]

While key separation seems prudent, it is not entirely clear (to me) 
whether the conditions under which this is required are precisely known 
(even in the above-mentioned case of signed certificate requests).

Best regards, Rene


On 1/16/2014 3:30 PM, David McGrew wrote:
> Hi Kevin, Paul, and Watson,
>
> On 01/16/2014 02:42 PM, Igoe, Kevin M. wrote:
>> Paul Lambert
>> On Thursday, January 16, 2014 1:43 AM Paul Lambert wrote:
>>
>>> A truly ‘unified' public key system would support both signatures and
>>> key establishment with the same key.
>>>
>> Received wisdom is that using the same key for both key establishment 
>> and
>> signatures is a bad idea.  I believe the concern is that one protocol
>> might be used an Oracle to subvert the other.
>
> Agreed on that point, but there is a background issue here that I want 
> to ask about.
>
> [snip]


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]