<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 2, 2017, at 11:30 PM, Dimitris Zacharopoulos via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" class="">
<div bgcolor="#FFFFFF" text="#000000" class="">
<div class="moz-cite-prefix">On 3/4/2017 3:39 πμ, Peter Bowen via
Public wrote:<br class="">
</div>
<blockquote cite="mid:632639CD-952E-4C41-B835-1468EA70DC74@amzn.com" type="cite" class="">
<pre wrap="" class="">I’m trying to draft a proposed revision to the BRs and ran into a terminology/style question.
Given:
Key Pair: a set of cryptographic keys, usable with an asymmetric key cryptographic algorithm, consisting of a Private Key, a Public Key, and associated parameters. For any given Private Key and parameter set, there exists exactly one associated Public Key.
A Certification Authority (CA) has a single Distinguished Name (DN)[1] and one or more Key Pairs[2]. Therefore a CA has at least one Private Key and at least one Public Key and may have multiple Private Keys and Public Keys.
Which of the following is preferred:
A Signature is created using a Private Key. (It is not created _by_ a Private Key.)
1A) A Certificate is issued by a CA when a Signature is created over a TBSCertificate with the Distinguished Name of a CA in the Issuer component using a Private Key of the CA.
1B) A Certificate is issued by a CA when a Signature is created over a TBSCertificate with the CA’s Distinguished Name in the Issuer component using the CA’s Private Key.
A Signature is the result of signing data using a Private Key. (It is not signed _by_ a Private Key.)
2A) A Certificate is issued by a CA when a TBSCertificate with the Distinguished Name of a CA in the Issuer component is signed using a Private Key of the CA.
2B) A Certificate is issued by a CA when a TBSCertificate with the CA’s Distinguished Name in the Issuer component is signed using the CA’s Private Key.
The difference been the A and B versions with whether or not to use a possessive noun with an inanimate object (the CA).
I would like to use one of these consistently and follow the style for other cases. Any one care to suggest which should be used?
Thanks,
Peter</pre>
</blockquote>
<br class="">
In these examples (1A, 1B, 2A, 2B), as I read it, "issued by a CA"
refers to the "Issuing CA" (materialized in a CA Certificate with a
specific subject DN which is then used in the "Issuer" field of
issued Certificates) and not the "CA" as an organization. This
actually reflects the language of X.509 and RFC5280 which basically
describe CAs as "Issuing CAs" rather than organizations in control
of one or more Issuing CAs, as the BRs often suggest. <br class=""></div></div></blockquote><div><br class=""></div>I was rather trying to avoid the CA-as-issuer vs CA-as-organization distinction in these examples. The primary reason I raised the 1:1 mapping (or lack thereof) is to explain why it is _the_ Distinguished Name vs _a_ Distinguished Name.</div><div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div bgcolor="#FFFFFF" text="#000000" class="">
Perhaps before answering your questions, we should probably agree on
this: If we have <br class="">
<ul class="">
<li class="">a CA Certificate with subject DN "C=XX, O=Example Org,
CN=Issuing CA", Certificate Serial Number A and keypair A</li>
<li class="">a CA Certificate with subject DN "C=XX, O=Example Org,
CN=Issuing CA", Certificate Serial Number B and and keypair B</li>
</ul><p class="">are we talking about the same "Issuing CA"?<br class="">
</p><p class="">Note1: You will notice that the "Certificate Serial Number" <u class="">is
not</u> the serialNumber field in the subject DN.</p><p class="">Note2: In order to achieve having exactly the same DN in CA
Certificates and different keys, you probably need to use
different Root hierarchies otherwise you would probably violate
section 4.1.2.6 of RFC5280 that require unique DN under one
Issuing CA. It the Issuing CA is a Root CA, then the issued CA
Certificates under this Root should have unique DNs. Does this
make sense</p></div></div></blockquote><div>A single issuing CA can have multiple keys if it rotates keys. There is at least one public CA that has done this.</div><div><br class=""></div><div>While not mentioned, two different Issuing CAs can have the same key pair. </div><div><br class=""></div><div>So, to answer your question: I would say those are both the same “Issuing CA”. </div><div><br class=""></div><div>Thanks,</div><div>Peter</div></div></body></html>