Subject: CGA Issue #11: Key lifetimes (Russ Housley)

From: "Tuomas Aura" <[email-masked]>
Date: Mon, 22 Mar 2004 13:39:02 -0800

Russ Housley:

  The security considerations ought to say something about the lifetime
  of the public/private key pair.  The one brief statement in section
7.3
  is not sufficient for an implementor to know how often the key pair
  needs to be changed.
  
---

Tuomas Aura:

There isn't any reason for changing the keys, except if the
host is compromised and its private keys may have leaked. 

I suggest adding the following to Section 7.1: 
 
  The impact of key compromise depends on the 
  application of the CGA-based signatures. In SEND, it is not a 
  major concern. The private signature key is typically stored 
  in the physical node that uses the CGA generated from the 
  corresponding public key. If the private key is compromised, it 
  is likely that the node itself has been compromised. If that is
  the case, the attacker does not need to spoof SEND messages
  from the node. When it is discovered that a node has
  been compromised, a new signature key and a new CGA SHOULD be 
  generated. The address change effectively revokes the 
  old public key. It is not necessary to have any additional 
  key revocation mechanism or to limit the lifetimes of the
  signature keys.

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

This communication is confidential and intended solely for the addressee(s). Any unauthorized review, use, disclosure or distribution is prohibited. If you believe this message has been sent to you in error, please notify the sender by replying to this transmission and delete the message without disclosing it. Thank you.

E-mail including attachments is susceptible to data corruption, interruption, unauthorized amendment, tampering and viruses, and we only send and receive e-mails on the basis that we are not liable for any such corruption, interception, amendment, tampering or viruses or any consequences thereof.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 31 Mar 2004 20:39:51 +0300

Tuomas,

I agree with the text you have provided, but what about
brute force attacks on RSA keys? I seem to remember that
the mandated key length is small, so perhaps with some
time on their hands, an attacker could discover the private
key without compromising the node. Maybe you should add
something about not keeping the keys longer than you
believe the keys are cryptographically safe? Or am I
missing something obvious?

--Jari