Online Certificate Revocation Protocol

["Mr Jonathan W Jenkyn" <[e-mail]>]

What is it you are trying to guard against here? Is it that the CSP would be
confused by the existence of two certificates with the same Subject and
Issuing DN? The inclusion of SubjectKeyIdentifier/AuthorityKeyIdentifier
would guard against this, and would still allow the client to have a
certificate with the same DN. Also the Serial number should also be
distinct, providing a visible mechanism for recipients of the certificate to
discern between the two certificates.
None of the x.500 DN components really fit into the scheme of being altered
under these circumstances.
After consideration, if the client had 2 key pairs one for signing/verify,
the other for decrypt/encrypt (the latter also held by the clients
organisation). Could not the clients organisation (under an instruction from
the client) request that the original signing key pair be revoked by
utilising the decrypting/encrypting key pair? Thereby passing responsibility
for revocation validation to the clients organisation (a better form of
authentication than a hotline!).

Regards

JJ

Jonathan Jenkyn
Head of Cryptographic Systems
De La Rue InterClear Limited
De La Rue House
Jays Close
Viables
Basingstoke
Hants
RG22

Telephone [phone]
Support Desk 01256 487777
http://www.interclear.com

-----Original Message-----
From: [e-mail] [mailto:[e-mail]]On
Behalf Of Hansen Wang
Sent: 08 June 2001 23:47
To: Tony Bartoletti
Cc: Housley, Russ; [e-mail]; [e-mail]
Subject: Re: Online Certificate Revocation Protocol




> A question:  If one discovers that they have accidently destroyed their
> private key (and there is no evidence of compromise), are they under any
> particular obligation to request revocation?  Is there any liability, or
> other real "downside" to simply getting a new key and keeping mum about
the
> fate of the former key?

Assuming that the entity which lost their private key wanted another
certificate with a new key pair but wanted the same name. What would
happen if their were two certificates in existance with the same name?
Wouldn't the CA not allow this? Or request documentation/proof (maybe
out-of-band methods) of ownership of the name and then the CA would
revoke the previous certificate base on the out-of-band proof and issue
a new one with the same name?

Hansen Wang <[e-mail]>