Cryptography Reference
In-Depth Information
LOCATION OF KEY PAIR AND CERTIFICATE CREATION
It is important to be aware of the fact that we are dealing with two separate
processes here:
• generation of the public-key pair itself;
• creation of the public-key certificate.
Key pair generation can be performed either by the owner of the public-key pair
or a trusted third party (who may or may not be the CA). The choice of location
for this operation results in different certificate creation scenarios:
Trusted third party generation
. In this scenario, a trusted third party (which
could be the CA) generates the public-key pair. If this trusted third party is not
the CA then they must contact the CA to arrange for certificate creation. The
advantages of this approach are that:
• the trusted third party may be better placed than the owner to conduct the
relatively complex operations involved in generation of the public-key pair (see
Section 10.3.4);
• the key pair generation process does not require the owner to do anything.
The possible disadvantages are that:
• the owner needs to trust the third party to securely distribute the private key to
the owner; the only exception to this is if the private key is managed on behalf
of the owner by the trusted third party, in which case processes must exist for
securely managing 'access' to the private key when the owner needs to use it.
• the owner needs to trust the third party to destroy the private key after it has
been distributed to the owner; an exception to this would be if the third party
provides a backup and recovery service for the owner (see Section 10.5.5).
This scenario lends itself most naturally to closed environments where a
trusted third party with the extra responsibilities outlined above can be
established.
Combined generation
. In this scenario, the owner of the key pair generates the
public-key pair. The owner then submits the public key to a CA for generation
of the public-key certificate. The main advantages of this approach are that:
• the owner is in full control of the key pair generation process;
• the private key can be locally generated and stored, without any need for it to
be distributed.
The possible disadvantages of this approach are that:
• the owner is required to have the ability to generate key pairs;
• the owner may need to demonstrate to the CA that the owner knows the private
key that corresponds to the public key submitted to the CA for certification
(we discuss this shortly).
This scenario is most suitable for open environments where owners wish to
control the key pair generation process themselves.
