Re: [pkix] Managing Long-Lived CA certs

Hi Max.

The "Private Key Usage Period" extension was present in RFC2459 and 
RFC3280 (see section 4.2.1.4), but was removed in RFC5280.  (Well, 
mostly removed; the ASN.1 definitions are still in Appendix A.2 ;-) ).

On 17/07/17 15:19, Dr. Pala wrote:
> Hi PKIX,
> 
> I have a small question for the list regarding long-lived CA 
> certificates. Especially in the context of device certificates, we often 
> see the use of extra long-lived certificates for Root and Sub CAs (e.g., 
> 35+ years) combined with limited key sizes (e.g., p256).
> 
> Until we have a supported mechanism for reprovisioning devices (...), 
> one possible solution for limiting the exposure of the private key would 
> be to have a scoped certificate issuance period.
> 
> What I am thinking about would be adding an extension that says: "This 
> CA can issue certificates from up to 5 years from the validFrom, after 
> this, just use it to provide revocation information". This might provide 
> some protection in case the CA key is compromised after the initial 5 
> years of validity (e.g., certificates issued after that date shall be 
> rejected).
> 
> Does such extension exists today ? If not, could this be some work for 
> LAMPS/SPASM WG ?
> 
> Cheers,
> Max
> 
> -- 
> Best Regards,
> Massimiliano Pala, Ph.D.
> OpenCA Labs Director
> OpenCA Logo
> 
> 
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix
> 

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online