CMP: generation of private keys

[Stefan Kelm <[e-mail]>]

I do not want to start the discussions about key generation again but the
following paragraph from draft-ietf-pkix-ipki3cmp-08.txt raises a question
to me:

: 2.2.1.3 Location of key generation
:
: In this specification, "key generation" is regarded as occurring
: wherever either the public or private component of a key pair first
: occurs in a PKIMessage. Note that this does not preclude a centralized
: key generation service - the actual key pair MAY have been generated
: elsewhere and transported to the end entity, RA, or CA using a
: (proprietary or standardized) key generation request/response protocol
: (outside the scope of this specification).
:
: There are thus three possibilities for the location of "key
: generation":  the end entity, an RA, or a CA.

In a legal context (esp. the German Signature law) a relying party might want
to know who generated the key pair of another end entity before deciding to
enter a contractual relationship with this entity. One might place trust
in another subject's certificate based on that question so wouldn't it make
sense to specify an optional certificate extension that indicates who
performed the process of key generation (eg. EE, CA, RA, other)?

I don't think this is merely a policy/CPS issue since the CA might not
address this issue in its policy. The German Signature law profile, for
example, in principle allows for the key material to be generated by either
the CA or the end entity (although the latter is very unlikely to happen
due to the technical requirements). So the relying party wouldn't get an
answer from reading the policy/CPS.

Comments?

        Stefan.

______________________________________________________________________________
Stefan Kelm            PGP key: "finger [e-mail]" or via key server
DFN-PCA, University of Hamburg                               <[e-mail]>
Vogt-Koelln-Str. 30                               http://www.pca.dfn.de/~kelm/
22527 Hamburg (Germany)          Tel: [phone] / Fax: [phone]