Re: proof-of-possession for DH keys

[Stephen Kent <kent@xxxxxxx>]

Adam,

Unfortunately, the possible consqquences are worse than the self-inflicted
DoS attack you descibed.  Specifically, by having a credible CA issue a
cert binding someone elses public key to the imposter's name, the imposter
can claim to be the signer of traffic associated with someone else (in the
case of a signature key bound into the certificate). This is a violation of
the nominal semantics of PKI use, and this should be avoided.  We've had
this discussion before, several times, and there was comcensus that POP is
important; the latitude that has been introduced into the specs is to allow
the CA to determine the means by which POP is achieved.  That's why the
cert management protocols do not mandate POP via a protocol exchange, even
though they do support this form of POP.

Steve