RE: Private Key Cloning

[lnightin@xxxxxxxxxx (Les Nightingill)]

I'm curious on the views of the "key cloning detractors" on the notable
disaster-recovery mitigation benefits of cloning. While the indirection
solution helps with load-sharing, it still leaves the root unrecoverable
under a no-clone policy.

I suppose I should check, but perhaps someone knows, too, whether an M-of-N
secret sharing scheme for disaster recovery of a root key is also
non-compliant with the German Digital Signature laws?

Les Nightingill
Cylink

-----Original Message-----
From: Michael Zolotarev [mailto:mzolotarev@baltimore.com]
Sent: Wednesday, June 21, 2000 5:19 PM
To: Jeff Davis; ietf-pkix@imc.org
Subject: RE: Private Key Cloning


Jeff wrote:
> The whole idea of having a private key is just that, it is
> private to a
> single entity and not shared across many other "clones" of
> that entity.
>
> IMHO, and it is very "H" in this case, cloning a private key, of any
> nature, is opening yourselves up to all sorts of repudiation
> claims.  If
> you clone once what stops you cloning "n" times without
> anyone knowing
> ( regardless of what procedures you have in place ).  Part of
> the basis
> of "trust" is that a private key only exists in one place under the
> strict control of the owner of that key.

The cloning procedure becomes a critical part, I agree. So the authority
would have to certify both the security/procedures of its operational
environment, and the security/procedures of key cloning. The same scale of
precautions that currently applies to keeping the [only and single] key
secure would apply to the cloning process. If you suspect that the cloning
may allow a criminal-minded high-privileged insider to perpetrate a fraud,
then for the same reason your should similarly suspect any other security
aspects of the authority operations.

We must always consider every particular case of key cloning, instead of
dismissing the whole concept. If a particular cloning procedure, executed by
a particular authority, using given hardware, in a particular secure
environment etc etc can be formally certified as being sufficiently secure,
at least not less(!) secure than the rest of the solution - what is wrong
with it?

If you can prove that your solution is secure - that would be just fine. Why
reject the approach on the basis that it MAY present a security hole.
Following that logic, whole PKI would be extinct by now.

>
> I support the views put forward that maybe the TSA root should sign
> certificates  for level 1 TSA Agents, of which there could be
> as many as
> required, but all of whom have a different DN ( very closely
> associated
> with the parent TSA ).  The trust of the Time Stamp would then be
> through a normal certificate chain and that only being 1 level.  Maybe
> the TSA root could then go offline leaving the "work horses"
> to perform
> the stamping.  Re-issuing of new TSA signing keys would then be quite
> easy for each Agent, with only 1 out of "n" Agents being
> offline at any
> one time, update the hardware signing module and get back online
> a.s.a.p.
>
> I may be well off the mark here, if so, just tell me to shut
> up and get
> back in the cupboard.  However, as I am trying to learn this stuff, a
> little help with my waywardness would go a long way.
>
I'm also new to the house. But I've learned that there are two words missing
in the group's dictionary - "beautiful" and "shut up". Three words, actually
:)

M