< draft-ietf-pkix-dhpop-02.txt   draft-ietf-pkix-dhpop-03.txt >
Internet Draft Hemma Prafullchandra (XETI) Internet Draft Hemma Prafullchandra (XETI)
Expires in 6 months Jim Schaad (Microsoft) Expires in 6 months Jim Schaad (Microsoft)
October 1, 1999 November 19, 2000
Diffie-Hellman Proof-of-Possession Algorithms Diffie-Hellman Proof-of-Possession Algorithms
<draft-ietf-pkix-dhpop-02.txt> <draft-ietf-pkix-dhpop-03.txt>
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. Internet-Drafts are working all provisions of Section 10 of RFC2026. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas, documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Internet-Drafts are working documents of the and its working groups. Internet-Drafts are working documents of the
Internet Engineering Task Force (IETF), its areas, and its working Internet Engineering Task Force (IETF), its areas, and its working
groups. Note that other groups MAY also distribute working groups. Note that other groups MAY also distribute working
documents as Internet-Drafts. documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six Internet-Drafts are draft documents valid for a maximum of six
months and MAY be updated, replaced, or obsoleted by other documents months and MAY be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress." reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at"
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt"
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at"
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html."
To learn the current status of any Internet-Draft, please check the To learn the current status of any Internet-Draft, please check the
"1id-abstracts.txt" listing contained in the Internet-Drafts Shadow "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow
Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe), Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
munari.oz.au Pacific Rim), ds.internic.net (US East Coast), or munari.oz.au Pacific Rim), ds.internic.net (US East Coast), or
ftp.isi.edu (US West Coast). ftp.isi.edu (US West Coast).
Abstract Abstract
This document describes two methods for producing a signature from a This document describes two methods for producing an integrity check
Diffie-Hellman key pair. This behavior is needed for such value from a Diffie-Hellman key pair. This behavior is needed for
operations as creating a signature of a PKCS #10 certification such operations as creating the signature of a PKCS #10
request. These algorithms are designed to provide a proof-of- certification request. These algorithms are designed to provide a
possession rather than general purpose signing. proof-of-possession rather than general purpose signing.
1. Introduction 1. Introduction
PKCS #10 [RFC2314] defines a syntax for certification requests. It PKCS #10 [RFC2314] defines a syntax for certification requests. It
assumes that the public key being requested for certification assumes that the public key being requested for certification
corresponds to an algorithm that is capable of signing/encrypting. corresponds to an algorithm that is capable of signing/encrypting.
Diffie-Hellman (DH) is a key agreement algorithm and as such cannot Diffie-Hellman (DH) is a key agreement algorithm and as such cannot
be directly used for signing or encryption. be directly used for signing or encryption.
This document describes two new signing algorithms using the Diffie- This document describes two new proof-of-possession algorithms using
Hellman key agreement process to provide a shared secret as the the Diffie-Hellman key agreement process to provide a shared secret
basis of the signature. In the first signature algorithm, the as the basis of an integrity check value. In the first algorithm,
signature is constructed for a specific recipient/verifier by using the value is constructed for a specific recipient/verifier by using
a public key of that verifier. In the second signature algorithm, a public key of that verifier. In the second algorithm, the value
the signature is constructed for arbitrary verifiers. This is done is constructed for arbitrary verifiers.
by creating an appropriate D-H key pair and encoding them as part of
the signature value.
Prafullchandra, Schaad 1
2. Terminology 2. Terminology
Prafullchandra, Schaad 1
The following definitions will be used in this document The following definitions will be used in this document
DH certificate = a certificate whose SubjectPublicKey is a DH public DH certificate = a certificate whose SubjectPublicKey is a DH public
value and is signed with any signature algorithm (e.g. rsa or dsa). value and is signed with any signature algorithm (e.g. RSA or DSA).
3. DH Signature Process 3. Static DH Proof-of-Possession Process
The steps for creating a DH signature are: The steps for creating a DH POP are:
1. An entity (E) chooses the group parameters for a DH key 1. An entity (E) chooses the group parameters for a DH key
agreement. agreement.
In many cases this is done simply by selecting the group This is done simply by selecting the group parameters from a
parameters from a certificate for the recipient of the signature certificate for the recipient of the POP process.
process (static DH signatures) but they may be computed for other
methods (ephemeral DH signatures).
In the ephemeral DH signature scheme, a temporary DH key-pair is A certificate with the correct group parameters has to be
generated using the group parameters, which may be computed or
acquired by some out-of-band means. In the static DH signature
scheme, a certificate with the correct group parameters has to be
available. Let these common DH parameters be g and p; and let available. Let these common DH parameters be g and p; and let
this DH key-pair be known as the Recipient key pair (Rpub and this DH key-pair be known as the Recipient key pair (Rpub and
Rpriv). Rpriv).
Rpub = g^x mod p (where x=Rpriv, the private DH value and Rpub = g^x mod p (where x=Rpriv, the private DH value and
^ denotes exponentiation) ^ denotes exponentiation)
2. The entity generates a DH public/private key-pair using the 2. The entity generates a DH public/private key-pair using the
parameters from step 1. parameters from step 1.
For an entity E: For an entity E:
Epriv = DH private value = y Epriv = DH private value = y
Epub = DH public value = g^y mod p Epub = DH public value = g^y mod p
3. The signature computation process will then consist of: 3. The POP computation process will then consist of:
a) The value to be signed is obtained. (For a RFC2314 object, the a) The value to be signed is obtained. (For a RFC2314 object, the
value is the DER encoded certificationRequestInfo field value is the DER encoded certificationRequestInfo field
represented as an octet string.) This will be the `text' represented as an octet string.) This will be the `text'
referred to in [RFC2104], the data to which HMAC-SHA1 is referred to in [RFC2104], the data to which HMAC-SHA1 is
applied. applied.
b) A shared DH secret is computed, as follows, b) A shared DH secret is computed, as follows,
shared secret = ZZ = g^xy mod p shared secret = ZZ = g^xy mod p
[This is done by the entity E as g^(y.Rpub) and by the [This is done by the entity E as Rpub^y and by the Recipient
Recipient as g^(x.Epub), where Rpub is retrieved from the as Epub^x, where Rpub is retrieved from the Recipient's DH
Recipient's DH certificate (or is the one that was locally certificate (or is the one that was locally generated by the
Entity) and Epub is retrieved from the actual certification
request. ]
Prafullchandra, Schaad 2 Prafullchandra, Schaad 2
generated by the Entity) and Epub is retrieved from the actual
certification request. ]
c) A temporary key K is derived from the shared secret ZZ as c) A temporary key K is derived from the shared secret ZZ as
follows: follows:
K = SHA1(LeadingInfo | ZZ | TrailingInfo), K = SHA1(LeadingInfo | ZZ | TrailingInfo),
where "|" means concatenation. where "|" means concatenation.
LeadingInfo ::= Subject Distinguished Name from certificate
TrailingInfo ::= Issuer Distinguished Name from certificate
d) Compute HMAC-SHA1 over the data `text' as per [RFC2104] as: d) Compute HMAC-SHA1 over the data `text' as per [RFC2104] as:
SHA1(K XOR opad, SHA1(K XOR ipad, text)) SHA1(K XOR opad, SHA1(K XOR ipad, text))
where, where,
opad (outer pad) = the byte 0x36 repeated 64 times and opad (outer pad) = the byte 0x36 repeated 64 times and
ipad (inner pad) = the byte 0x5C repeated 64 times. ipad (inner pad) = the byte 0x5C repeated 64 times.
Namely, Namely,
(1) Append zeros to the end of K to create a 64 byte string (1) Append zeros to the end of K to create a 64 byte string
skipping to change at line 153 skipping to change at line 149
(6) Append the SHA1 result from step (4) to the 64 byte (6) Append the SHA1 result from step (4) to the 64 byte
string resulting from step (5). string resulting from step (5).
(7) Apply SHA1 to the stream generated in step (6) and (7) Apply SHA1 to the stream generated in step (6) and
output the result. output the result.
Sample code is also provided in [RFC2104]. Sample code is also provided in [RFC2104].
e) The output of (d) is encoded as a BIT STRING (the Signature e) The output of (d) is encoded as a BIT STRING (the Signature
value). value).
The signature verification process requires the Recipient to carry The POP verification process requires the Recipient to carry out
out steps (a) through (d) and then simply compare the result of step steps (a) through (d) and then simply compare the result of step (d)
(d) with what it received as the signature component. If they match with what it received as the signature component. If they match then
then the following can be concluded: the following can be concluded:
a) The Entity possesses the private key corresponding to the a) The Entity possesses the private key corresponding to the
public key in the certification request because it needed the public key in the certification request because it needed the
private key to calculate the shared secret; and private key to calculate the shared secret; and
b) For the static signature scheme, that only the Recipient that b) Only the Recipient that the entity sent the request to could
the entity sent the request to could actually verify the actually verify the request because they would require their
request because they would require their own private key to own private key to compute the same shared secret. In the case
compute the same shared secret. In the case where the where the recipient is a Certification Authority, this
recipient is a Certification Authority, this protects the protects the Entity from rogue CAs.
Entity from rogue CAs.
4. Static DH Signature
Prafullchandra, Schaad 3 Prafullchandra, Schaad 3
In the static DH Signature scheme, the public key used in the key ASN Encoding
agreement process of step 2 is obtained from the entity that will be
verifying the signature (i.e. the recipient). In the case of a
certification request, the public key would normally be extracted
from a certificate issued to the CA with the appropriate key
parameters.
The values used in step 3c for "LeadingInfo" and the "TrailingInfo"
are:
LeadingInfo ::= Subject Distinguished Name from certificate
TrailingInfo ::= Issuer Distinguished Name from certificate
The ASN.1 structures associated with the static Diffie-Hellman The ASN.1 structures associated with the static Diffie-Hellman POP
signature algorithms are: algorithm are:
id-dhPop-static-HMAC-SHA1 OBJECT IDENTIFIER ::= { id-pkix id-dhPop-static-HMAC-SHA1 OBJECT IDENTIFIER ::= { id-pkix
id-alg(6) 3} id-alg(6) 3}
DhPopStatic ::= SEQUENCE { DhPopStatic ::= SEQUENCE {
issuerAndSerial IssuerAndSerialNumber OPTIONAL, issuerAndSerial IssuerAndSerialNumber OPTIONAL,
hashValue MessageDigest hashValue MessageDigest
} }
issuerAndSerial is the issuer name and serial number of the issuerAndSerial is the issuer name and serial number of the
certificate from which the public key was obtained. The certificate from which the public key was obtained. The
issuerAndSerial field is omitted if the public key did not come issuerAndSerial field is omitted if the public key did not come
from a certificate. from a certificate.
hashValue contains the result of the SHA-1 HMAC operation in step hashValue contains the result of the SHA-1 HMAC operation in step
3d. 3d.
DhPopStatic is encoded as a BIT STRING and is the signature value DhPopStatic is encoded as a BIT STRING and is the signature value
(i.e. encodes the above sequence instead of the raw output from 3d). (i.e. encodes the above sequence instead of the raw output from 3d).
5. Discrete Logarithm Signature 4. Discrete Logarithm Signature
The use of a single set of parameters for an entire public key The use of a single set of parameters for an entire public key
infrastructure allows all keys in the group to be attacked together. infrastructure allows all keys in the group to be attacked together.
For this reason we need to create a proof of possession for Diffie- For this reason we need to create a proof of possession for Diffie-
Hellman keys that does not require the use of a common set of Hellman keys that does not require the use of a common set of
parameters. parameters.
The method outlined in this document is the same as used by the The method outlined in this document is the same as used by the
Digital Signature Algorithm, but we have removed the restrictions Digital Signature Algorithm, but we have removed the restrictions
imposed by the [FIPS-186] standard. The use of this method does imposed by the [FIPS-186] standard. The use of this method does
impose some additional restrictions on the set of keys that may be impose some additional restrictions on the set of keys that may be
used, however if the key generation algorithm documented in [DH- used, however if the key generation algorithm documented in [DH-
X9.42] is used the required restrictions are met. The additional X9.42] is used the required restrictions are met. The additional
restrictions are the requirement for the existence of a q parameter. restrictions are the requirement for the existence of a q parameter.
Adding the q parameter is generally accepted as a good practice as Adding the q parameter is generally accepted as a good practice as
it allows for checking of small group attacks. it allows for checking of small group attacks.
Prafullchandra, Schaad 4
The following definitions are used in the rest of this section: The following definitions are used in the rest of this section:
p is a large prime p is a large prime
g = h(p-1)/q mod p , g = h(p-1)/q mod p ,
where h is any integer 1 < h < p-1 such that h(p-1) mod q > 1 where h is any integer 1 < h < p-1 such that h(p-1) mod q > 1
(g has order q mod p) (g has order q mod p)
q is a large prime q is a large prime
j is a large integer such that p = qj + 1 j is a large integer such that p = qj + 1
x is a randomly or pseudo-randomly generated integer with x is a randomly or pseudo-randomly generated integer with
Prafullchandra, Schaad 4
1 < x < q 1 < x < q
y = g^x mod p y = g^x mod p
Note: These definitions match the ones in [DH-X9.42]. Note: These definitions match the ones in [DH-X9.42].
5.1 Expanding the Digest Value 4.1 Expanding the Digest Value
Besides the addition of a q parameter, [FIPS-186] also imposes size Besides the addition of a q parameter, [FIPS-186] also imposes size
restrictions on the parameters. The length of q must be 160-bits restrictions on the parameters. The length of q must be 160-bits
(matching output of the SHA-1 digest algorithm) and length of p must (matching output of the SHA-1 digest algorithm) and length of p must
be 1024-bits. The size restriction on p is eliminated in this be 1024-bits. The size restriction on p is eliminated in this
document, but the size restriction on q is replaced with the document, but the size restriction on q is replaced with the
requirement that q must be at least 160-bits. (The size restriction requirement that q must be at least 160-bits. (The size restriction
on q is identical with that in [DH-X9.42].) on q is identical with that in [DH-X9.42].)
Given that there is not a random length-hashing algorithm, a hash Given that there is not a random length-hashing algorithm, a hash
skipping to change at line 270 skipping to change at line 253
This algorithm produces m the value to be signed. This algorithm produces m the value to be signed.
Let L = the size of q (i.e. 2^L <= q < 2^(L+1)). Let L = the size of q (i.e. 2^L <= q < 2^(L+1)).
Let M be the original message to be signed. Let M be the original message to be signed.
1. Compute d = SHA-1(M), the SHA-1 digest of the original message. 1. Compute d = SHA-1(M), the SHA-1 digest of the original message.
2. If L == 160 then m = d. 2. If L == 160 then m = d.
3. If L @ 160 then follow steps (a) through (d) below. 3. If L > 160 then follow steps (a) through (d) below.
a) Set n = L / 160, where / represents integer division, a) Set n = L / 160, where / represents integer division,
consequently, if L = 200, n = 1. consequently, if L = 200, n = 1.
b) Set m = d, the initial computed digest value. b) Set m = d, the initial computed digest value.
c) For i = 0 to n - 1 c) For i = 0 to n - 1
m = m | SHA(m), where "|" means concatenation. m = m | SHA(m), where "|" means concatenation.
d) m = LEFTMOST(m, L-1), where LEFTMOST returns the L-1 left most d) m = LEFTMOST(m, L-1), where LEFTMOST returns the L-1 left most
bits of m. bits of m.
Prafullchandra, Schaad 5
Thus the final result of the process meets the criteria that 0 <= m Thus the final result of the process meets the criteria that 0 <= m
< q. < q.
5.2 Signature Computation Algorithm 4.2 Signature Computation Algorithm
The signature algorithm produces the pair of values (r, s), which is The signature algorithm produces the pair of values (r, s), which is
the signature. The signature is computed as follows: the signature. The signature is computed as follows:
Given m, the value to be signed, as well as the parameters defined Given m, the value to be signed, as well as the parameters defined
earlier in section 5. earlier in section 5.
Prafullchandra, Schaad 5
1. Generate a random or pseudorandom integer k, such that 0 < k^-1 < 1. Generate a random or pseudorandom integer k, such that 0 < k^-1 <
q. q.
2. Compute r = (g^k mod p) mod q. 2. Compute r = (g^k mod p) mod q.
3. If r is zero, repeat from step 1. 3. If r is zero, repeat from step 1.
4. Compute s = (k^-1 (m + xr)) mod q. 4. Compute s = (k^-1 (m + xr)) mod q.
5. If s is zero, repeat from step 1. 5. If s is zero, repeat from step 1.
5.3 Signature Verification Algorithm 4.3 Signature Verification Algorithm
The signature verification process is far more complicated than is The signature verification process is far more complicated than is
normal for the Digital Signature Algorithm, as some assumptions normal for the Digital Signature Algorithm, as some assumptions
about the validity of parameters cannot be taken for granted. about the validity of parameters cannot be taken for granted.
Given a message m to be validated, the signature value pair (r, s) Given a message m to be validated, the signature value pair (r, s)
and the parameters for the key. and the parameters for the key.
1. Perform a strong verification that p is a prime number. 1. Perform a strong verification that p is a prime number.
skipping to change at line 333 skipping to change at line 316
6. Compute u1 = m*w mod q. 6. Compute u1 = m*w mod q.
7. Compute u2 = r*w mod q. 7. Compute u2 = r*w mod q.
8. Compute v = ((g^u1 * y^u2) mod p) mod q. 8. Compute v = ((g^u1 * y^u2) mod p) mod q.
9. Compare v and r, if they are the same then the signature verified 9. Compare v and r, if they are the same then the signature verified
correctly. correctly.
5.4 ASN Encoding 4.4 ASN Encoding
Prafullchandra, Schaad 6
The signature is encoded using The signature is encoded using
id-alg-dhPOP OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 4} id-alg-dhPOP OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 4}
The parameters for id-alg-dhPOP are encoded as DomainParameters The parameters for id-alg-dhPOP are encoded as DomainParameters
(imported from [PROFILE]). The parameters may be omitted in the (imported from [PROFILE]). The parameters may be omitted in the
signature, as they must exist in the associated key request. signature, as they must exist in the associated key request.
The signature value pair r and s are encoded using Dss-Sig-Value The signature value pair r and s are encoded using Dss-Sig-Value
(imported from [PROFILE]). (imported from [PROFILE]).
Prafullchandra, Schaad 6
5. Security Considerations 5. Security Considerations
In the static DH POP algorithm, an appropriate value can be produced
by either party. Thus this algorithm only provides integrity and
not origination service. The Discrete Logarithm algorithm provides
both integrity checking and origination checking.
All the security in this system is provided by the secrecy of the All the security in this system is provided by the secrecy of the
private keying material. If either sender or recipient private keys private keying material. If either sender or recipient private keys
are disclosed, all messages sent or received using that key are are disclosed, all messages sent or received using that key are
compromised. Similarly, loss of the private key results in an compromised. Similarly, loss of the private key results in an
inability to read messages sent using that key. inability to read messages sent using that key.
Selection of parameters can be of paramount importance. In the Selection of parameters can be of paramount importance. In the
selection of parameters one must take into account the community/ selection of parameters one must take into account the community/
group of entities that one wishes to be able to communicate with. group of entities that one wishes to be able to communicate with.
In choosing a set of parameters one must also be sure to avoid small In choosing a set of parameters one must also be sure to avoid small
skipping to change at line 389 skipping to change at line 377
[DH-X9.42] E. Rescorla, "Diffie-Hellman Key Agreement Method". [DH-X9.42] E. Rescorla, "Diffie-Hellman Key Agreement Method".
RFC 2631, June 1999. RFC 2631, June 1999.
7. Author's Addresses 7. Author's Addresses
Hemma Prafullchandra Hemma Prafullchandra
XETI Inc. XETI Inc.
5150 El Camino Real, #A-32 5150 El Camino Real, #A-32
Los Altos, CA 94022 Los Altos, CA 94022
Prafullchandra, Schaad 7
(640) 694-6812 (640) 694-6812
hemma@xeti.com hemma@xeti.com
Jim Schaad Jim Schaad
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052-6399
(425) 936-3101
jimsch@microsoft.com
Prafullchandra, Schaad 8 jimsch@exmsft.com
Prafullchandra, Schaad 7
Appendix A. ASN.1 Module Appendix A. ASN.1 Module
DH-Sign DEFINITIONS IMPLICIT TAGS ::= DH-Sign DEFINITIONS IMPLICIT TAGS ::=
BEGIN BEGIN
--EXPORTS ALL --EXPORTS ALL
-- The types and values defined in this module are exported for use -- The types and values defined in this module are exported for use
in in
-- the other ASN.1 modules. Other applications may use them for -- the other ASN.1 modules. Other applications may use them for
their their
skipping to change at line 436 skipping to change at line 419
DhSigStatic ::= SEQUENCE { DhSigStatic ::= SEQUENCE {
IssuerAndSerial IssuerAndSerialNumber OPTIONAL, IssuerAndSerial IssuerAndSerialNumber OPTIONAL,
hashValue MessageDigest hashValue MessageDigest
} }
id-alg-dh-pop OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 4} id-alg-dh-pop OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 4}
END END
Prafullchandra, Schaad 9 Prafullchandra, Schaad 8
Appendix B. Example of Static DH Signature Appendix B. Example of Static DH Proof-of-Possession
The following example follows the steps described earlier in section The following example follows the steps described earlier in section
3. 3.
Step 1: Establishing common Diffie-Hellman parameters. Assume the Step 1: Establishing common Diffie-Hellman parameters. Assume the
parameters are as in the DER encoded certificate. The certificate parameters are as in the DER encoded certificate. The certificate
contains a DH public key signed by a CA with a DSA signing key. contains a DH public key signed by a CA with a DSA signing key.
0 30 939: SEQUENCE { 0 30 939: SEQUENCE {
4 30 872: SEQUENCE { 4 30 872: SEQUENCE {
skipping to change at line 491 skipping to change at line 474
: } : }
: } : }
: } : }
108 30 30: SEQUENCE { 108 30 30: SEQUENCE {
110 17 13: UTCTime '990914010557Z' 110 17 13: UTCTime '990914010557Z'
125 17 13: UTCTime '991113010557Z' 125 17 13: UTCTime '991113010557Z'
: } : }
140 30 70: SEQUENCE { 140 30 70: SEQUENCE {
142 31 11: SET { 142 31 11: SET {
Prafullchandra, Schaad 10 Prafullchandra, Schaad 9
144 30 9: SEQUENCE { 144 30 9: SEQUENCE {
146 06 3: OBJECT IDENTIFIER countryName (2 5 4 6) 146 06 3: OBJECT IDENTIFIER countryName (2 5 4 6)
151 13 2: PrintableString 'US' 151 13 2: PrintableString 'US'
: } : }
: } : }
155 31 17: SET { 155 31 17: SET {
157 30 15: SEQUENCE { 157 30 15: SEQUENCE {
159 06 3: OBJECT IDENTIFIER organizationName (2 5 4 10) 159 06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)
164 13 8: PrintableString 'XETI Inc' 164 13 8: PrintableString 'XETI Inc'
: } : }
skipping to change at line 547 skipping to change at line 530
: 47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1 : 47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1
: 39 9A FF 04 D5 6E 7E 94 3D 03 B8 F6 31 15 26 48 : 39 9A FF 04 D5 6E 7E 94 3D 03 B8 F6 31 15 26 48
: 95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD : 95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD
496 02 33: INTEGER 496 02 33: INTEGER
: 00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94 : 00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94
: B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30 : B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30
: FB : FB
531 02 97: INTEGER 531 02 97: INTEGER
: 00 A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7 : 00 A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7
Prafullchandra, Schaad 11 Prafullchandra, Schaad 10
: B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D : B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D
: AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39 : AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39
: 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76 : 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76
: B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56 : B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56
: 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2 : 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2
: 92 : 92
630 30 26: SEQUENCE { 630 30 26: SEQUENCE {
632 03 21: BIT STRING 0 unused bits 632 03 21: BIT STRING 0 unused bits
: 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB : 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB
: 09 E4 98 34 : 09 E4 98 34
skipping to change at line 603 skipping to change at line 586
874 04 4: OCTET STRING 874 04 4: OCTET STRING
: 03 02 03 08 : 03 02 03 08
: } : }
: } : }
: } : }
: } : }
880 30 11: SEQUENCE { 880 30 11: SEQUENCE {
882 06 7: OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3) 882 06 7: OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
891 05 0: NULL 891 05 0: NULL
Prafullchandra, Schaad 12 Prafullchandra, Schaad 11
: } : }
893 03 48: BIT STRING 0 unused bits 893 03 48: BIT STRING 0 unused bits
: 30 2D 02 14 7C 6D D2 CA 1E 32 D1 30 2E 29 66 BC : 30 2D 02 14 7C 6D D2 CA 1E 32 D1 30 2E 29 66 BC
: 06 8B 60 C7 61 16 3B CA 02 15 00 8A 18 DD C1 83 : 06 8B 60 C7 61 16 3B CA 02 15 00 8A 18 DD C1 83
: 58 29 A2 8A 67 64 03 92 AB 02 CE 00 B5 94 6A : 58 29 A2 8A 67 64 03 92 AB 02 CE 00 B5 94 6A
: } : }
Step 2. End Entity/User generates a Diffie-Hellman key-pair using Step 2. End Entity/User generates a Diffie-Hellman key-pair using
the parameters from the CA certificate. the parameters from the CA certificate.
skipping to change at line 654 skipping to change at line 637
30 46 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 30 46 31 0B 30 09 06 03 55 04 06 13 02 55 53 31
11 30 0F 06 03 55 04 0A 13 08 58 45 54 49 20 49 11 30 0F 06 03 55 04 0A 13 08 58 45 54 49 20 49
6E 63 31 10 30 0E 06 03 55 04 0B 13 07 54 65 73 6E 63 31 10 30 0E 06 03 55 04 0B 13 07 54 65 73
74 69 6E 67 31 12 30 10 06 03 55 04 03 13 09 44 74 69 6E 67 31 12 30 10 06 03 55 04 03 13 09 44
48 20 54 65 73 74 43 41 48 20 54 65 73 74 43 41
K: K:
F4 D7 BB 6C C7 2D 21 7F 1C 38 F7 DA 74 2D 51 AD F4 D7 BB 6C C7 2D 21 7F 1C 38 F7 DA 74 2D 51 AD
14 40 66 75 14 40 66 75
TBS: the "text" for computing the SHA-1 HMAC. TBS: the ôtextö for computing the SHA-1 HMAC.
Prafullchandra, Schaad 13 Prafullchandra, Schaad 12
30 82 02 98 02 01 00 30 4E 31 0B 30 09 06 03 55 30 82 02 98 02 01 00 30 4E 31 0B 30 09 06 03 55
04 06 13 02 55 53 31 11 30 0F 06 03 55 04 0A 13 04 06 13 02 55 53 31 11 30 0F 06 03 55 04 0A 13
08 58 45 54 49 20 49 6E 63 31 10 30 0E 06 03 55 08 58 45 54 49 20 49 6E 63 31 10 30 0E 06 03 55
04 0B 13 07 54 65 73 74 69 6E 67 31 1A 30 18 06 04 0B 13 07 54 65 73 74 69 6E 67 31 1A 30 18 06
03 55 04 03 13 11 50 4B 49 58 20 45 78 61 6D 70 03 55 04 03 13 11 50 4B 49 58 20 45 78 61 6D 70
6C 65 20 55 73 65 72 30 82 02 41 30 82 01 B6 06 6C 65 20 55 73 65 72 30 82 02 41 30 82 01 B6 06
07 2A 86 48 CE 3E 02 01 30 82 01 A9 02 81 81 00 07 2A 86 48 CE 3E 02 01 30 82 01 A9 02 81 81 00
94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 C5 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 C5
A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82 F5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82 F5
D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 51 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 51
skipping to change at line 711 skipping to change at line 694
0 30 793: SEQUENCE { 0 30 793: SEQUENCE {
4 30 664: SEQUENCE { 4 30 664: SEQUENCE {
8 02 1: INTEGER 0 8 02 1: INTEGER 0
11 30 78: SEQUENCE { 11 30 78: SEQUENCE {
13 31 11: SET { 13 31 11: SET {
15 30 9: SEQUENCE { 15 30 9: SEQUENCE {
17 06 3: OBJECT IDENTIFIER countryName (2 5 4 6) 17 06 3: OBJECT IDENTIFIER countryName (2 5 4 6)
22 13 2: PrintableString 'US' 22 13 2: PrintableString 'US'
Prafullchandra, Schaad 14 Prafullchandra, Schaad 13
: } : }
: } : }
26 31 17: SET { 26 31 17: SET {
28 30 15: SEQUENCE { 28 30 15: SEQUENCE {
30 06 3: OBJECT IDENTIFIER organizationName (2 5 4 10) 30 06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)
35 13 8: PrintableString 'XETI Inc' 35 13 8: PrintableString 'XETI Inc'
: } : }
: } : }
45 31 16: SET { 45 31 16: SET {
47 30 14: SEQUENCE { 47 30 14: SEQUENCE {
skipping to change at line 767 skipping to change at line 750
375 02 33: INTEGER 375 02 33: INTEGER
: 00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94 : 00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94
: B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30 : B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30
: FB : FB
410 02 97: INTEGER 410 02 97: INTEGER
: 00 A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7 : 00 A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7
: B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D : B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D
: AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39 : AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39
: 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76 : 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76
Prafullchandra, Schaad 15 Prafullchandra, Schaad 14
: B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56 : B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56
: 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2 : 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2
: 92 : 92
509 30 26: SEQUENCE { 509 30 26: SEQUENCE {
511 03 21: BIT STRING 0 unused bits 511 03 21: BIT STRING 0 unused bits
: 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E : 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E
DB DB
: 09 E4 98 34 : 09 E4 98 34
534 02 1: INTEGER 55 534 02 1: INTEGER 55
: } : }
skipping to change at line 806 skipping to change at line 789
686 03 109: BIT STRING 0 unused bits 686 03 109: BIT STRING 0 unused bits
: 30 6A 30 52 30 48 31 0B 30 09 06 03 55 04 06 13 : 30 6A 30 52 30 48 31 0B 30 09 06 03 55 04 06 13
: 02 55 53 31 11 30 0F 06 03 55 04 0A 13 08 58 45 : 02 55 53 31 11 30 0F 06 03 55 04 0A 13 08 58 45
: 54 49 20 49 6E 63 31 10 30 0E 06 03 55 04 0B 13 : 54 49 20 49 6E 63 31 10 30 0E 06 03 55 04 0B 13
: 07 54 65 73 74 69 6E 67 31 14 30 12 06 03 55 04 : 07 54 65 73 74 69 6E 67 31 14 30 12 06 03 55 04
: 03 13 0B 52 6F 6F 74 20 44 53 41 20 43 41 02 06 : 03 13 0B 52 6F 6F 74 20 44 53 41 20 43 41 02 06
: 00 DA 39 B6 E2 CB 04 14 1B 17 AD 4E 65 86 1A 6C : 00 DA 39 B6 E2 CB 04 14 1B 17 AD 4E 65 86 1A 6C
: 7C 85 FA F7 95 DE 48 93 C5 9D C5 24 : 7C 85 FA F7 95 DE 48 93 C5 9D C5 24
: } : }
Signature verification requires CA's private key, the CA certificate Signature verification requires CAÆs private key, the CA certificate
and the generated Certification Request. and the generated Certification Request.
CA DH private key: CA DH private key:
x: 3E 5D AD FD E5 F4 6B 1B 61 5E 18 F9 0B 84 74 a7 x: 3E 5D AD FD E5 F4 6B 1B 61 5E 18 F9 0B 84 74 a7
52 1E D6 92 BC 34 94 56 F3 0C BE DA 67 7A DD 7D 52 1E D6 92 BC 34 94 56 F3 0C BE DA 67 7A DD 7D
Prafullchandra, Schaad 16 Prafullchandra, Schaad 15
Appendix C. Example of Discrete Log Signature Appendix C. Example of Discrete Log Signature
Step 1. Generate a Diffie-Hellman Key with length of q being 256- Step 1. Generate a Diffie-Hellman Key with length of q being 256-
bits. bits.
p: p:
94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 C5 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 C5
A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82 F5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82 F5
D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 51 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 51
63 02 86 AA 06 B8 21 36 B6 7F 36 DF D1 D6 68 5B 63 02 86 AA 06 B8 21 36 B6 7F 36 DF D1 D6 68 5B
skipping to change at line 869 skipping to change at line 852
3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 4D F2 C6 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 4D F2 C6
ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 8F C5 1A ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 8F C5 1A
seed: seed:
1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB
09 E4 98 34 09 E4 98 34
C: C:
00000037 00000037
Prafullchandra, Schaad 17 Prafullchandra, Schaad 16
x: x:
3E 5D AD FD E5 F4 6B 1B 61 5E 18 F9 0B 84 74 a7 3E 5D AD FD E5 F4 6B 1B 61 5E 18 F9 0B 84 74 a7
52 1E D6 92 BC 34 94 56 F3 0C BE DA 67 7A DD 7D 52 1E D6 92 BC 34 94 56 F3 0C BE DA 67 7A DD 7D
Step 2. Form the value to be signed and hash with SHA1. The result Step 2. Form the value to be signed and hash with SHA1. The result
of the hash for this example is: of the hash for this example is:
5f a2 69 b6 4b 22 91 22 6f 4c fe 68 ec 2b d1 c6 5f a2 69 b6 4b 22 91 22 6f 4c fe 68 ec 2b d1 c6
d4 21 e5 2c d4 21 e5 2c
Step 3. The hash value needs to be expanded since |q| = 256. This Step 3. The hash value needs to be expanded since |q| = 256. This
skipping to change at line 924 skipping to change at line 907
30 82 02 c2 30 82 02 67 02 01 00 30 1b 31 19 30 30 82 02 c2 30 82 02 67 02 01 00 30 1b 31 19 30
17 06 03 55 04 03 13 10 49 45 54 46 20 50 4b 49 17 06 03 55 04 03 13 10 49 45 54 46 20 50 4b 49
58 20 53 41 4d 50 4c 45 30 82 02 41 30 82 01 b6 58 20 53 41 4d 50 4c 45 30 82 02 41 30 82 01 b6
06 07 2a 86 48 ce 3e 02 01 30 82 01 a9 02 81 81 06 07 2a 86 48 ce 3e 02 01 30 82 01 a9 02 81 81
00 94 84 e0 45 6c 7f 69 51 62 3e 56 80 7c 68 e7 00 94 84 e0 45 6c 7f 69 51 62 3e 56 80 7c 68 e7
c5 a9 9e 9e 74 74 94 ed 90 8c 1d c4 e1 4a 14 82 c5 a9 9e 9e 74 74 94 ed 90 8c 1d c4 e1 4a 14 82
f5 d2 94 0c 19 e3 b9 10 bb 11 b9 e5 a5 fb 8e 21 f5 d2 94 0c 19 e3 b9 10 bb 11 b9 e5 a5 fb 8e 21
51 63 02 86 aa 06 b8 21 36 b6 7f 36 df d1 d6 68 51 63 02 86 aa 06 b8 21 36 b6 7f 36 df d1 d6 68
5b 79 7c 1d 5a 14 75 1f 6a 93 75 93 ce bb 97 72 5b 79 7c 1d 5a 14 75 1f 6a 93 75 93 ce bb 97 72
Prafullchandra, Schaad 18 Prafullchandra, Schaad 17
8a f0 0f 23 9d 47 f6 d4 b3 c7 f0 f4 e6 f6 2b c2 8a f0 0f 23 9d 47 f6 d4 b3 c7 f0 f4 e6 f6 2b c2
32 e1 89 67 be 7e 06 ae f8 d0 01 6b 8b 2a f5 02 32 e1 89 67 be 7e 06 ae f8 d0 01 6b 8b 2a f5 02
d7 b6 a8 63 94 83 b0 1b 31 7d 52 1a de e5 03 85 d7 b6 a8 63 94 83 b0 1b 31 7d 52 1a de e5 03 85
27 02 81 80 26 a6 32 2c 5a 2b d4 33 2b 5c dc 06 27 02 81 80 26 a6 32 2c 5a 2b d4 33 2b 5c dc 06
87 53 3f 90 06 61 50 38 3e d2 b9 7d 81 1c 12 10 87 53 3f 90 06 61 50 38 3e d2 b9 7d 81 1c 12 10
c5 0c 53 d4 64 d1 8e 30 07 08 8c dd 3f 0a 2f 2c c5 0c 53 d4 64 d1 8e 30 07 08 8c dd 3f 0a 2f 2c
d6 1b 7f 57 86 d0 da bb 6e 36 2a 18 e8 d3 bc 70 d6 1b 7f 57 86 d0 da bb 6e 36 2a 18 e8 d3 bc 70
31 7a 48 b6 4e 18 6e dd 1f 22 06 eb 3f ea d4 41 31 7a 48 b6 4e 18 6e dd 1f 22 06 eb 3f ea d4 41
69 d9 9b de 47 95 7a 72 91 d2 09 7f 49 5c 3b 03 69 d9 9b de 47 95 7a 72 91 d2 09 7f 49 5c 3b 03
33 51 c8 f1 39 9a ff 04 d5 6e 7e 94 3d 03 b8 f6 33 51 c8 f1 39 9a ff 04 d5 6e 7e 94 3d 03 b8 f6
skipping to change at line 978 skipping to change at line 961
13 31 25: SET { 13 31 25: SET {
15 30 23: SEQUENCE { 15 30 23: SEQUENCE {
17 06 3: OBJECT IDENTIFIER commonName (2 5 4 3) 17 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)
22 13 16: PrintableString 'IETF PKIX SAMPLE' 22 13 16: PrintableString 'IETF PKIX SAMPLE'
: } : }
: } : }
: } : }
40 30 577: SEQUENCE { 40 30 577: SEQUENCE {
44 30 438: SEQUENCE { 44 30 438: SEQUENCE {
Prafullchandra, Schaad 19 Prafullchandra, Schaad 18
48 06 7: OBJECT IDENTIFIER dhPublicNumber (1 2 840 10046 2 48 06 7: OBJECT IDENTIFIER dhPublicNumber (1 2 840 10046 2
1) 1)
57 30 425: SEQUENCE { 57 30 425: SEQUENCE {
61 02 129: INTEGER 61 02 129: INTEGER
: 00 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 : 00 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7
: C5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82 : C5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82
: F5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 : F5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21
: 51 63 02 86 AA 06 B8 21 36 B6 7F 36 DF D1 D6 68 : 51 63 02 86 AA 06 B8 21 36 B6 7F 36 DF D1 D6 68
: 5B 79 7C 1D 5A 14 75 1F 6A 93 75 93 CE BB 97 72 : 5B 79 7C 1D 5A 14 75 1F 6A 93 75 93 CE BB 97 72
: 8A F0 0F 23 9D 47 F6 D4 B3 C7 F0 F4 E6 F6 2B C2 : 8A F0 0F 23 9D 47 F6 D4 B3 C7 F0 F4 E6 F6 2B C2
skipping to change at line 1034 skipping to change at line 1017
: 46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69 : 46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69
: B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22 : B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22
: 4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF : 4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF
: D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21 : D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21
: E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 : E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31
: 4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 : 4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0
: 8F C5 1A : 8F C5 1A
: } : }
621 A0 0: [0] 621 A0 0: [0]
Prafullchandra, Schaad 20 Prafullchandra, Schaad 19
: } : }
623 30 12: SEQUENCE { 623 30 12: SEQUENCE {
625 06 8: OBJECT IDENTIFIER '1 3 6 1 5 5 7 6 4' 625 06 8: OBJECT IDENTIFIER '1 3 6 1 5 5 7 6 4'
635 05 0: NULL 635 05 0: NULL
: } : }
637 03 72: BIT STRING 0 unused bits 637 03 72: BIT STRING 0 unused bits
: 30 45 02 21 00 A1 B5 B4 90 01 34 6B A0 31 6A 73 : 30 45 02 21 00 A1 B5 B4 90 01 34 6B A0 31 6A 73
: F5 7D F6 5C 14 43 52 D2 10 BF 86 58 87 F7 BC 6E : F5 7D F6 5C 14 43 52 D2 10 BF 86 58 87 F7 BC 6E
: 5A 77 FF C3 4B 02 20 59 40 45 BC 6F 0D DC FF 9D : 5A 77 FF C3 4B 02 20 59 40 45 BC 6F 0D DC FF 9D
: 55 40 1E C4 9E 51 3D 66 EF B2 FF 06 40 9A 39 68 : 55 40 1E C4 9E 51 3D 66 EF B2 FF 06 40 9A 39 68
: 75 81 F7 EC 9E BE A1 : 75 81 F7 EC 9E BE A1
: } : }
Prafullchandra, Schaad 21 Prafullchandra, Schaad 20
http://www.nwlink.com
 End of changes. 53 change blocks. 
96 lines changed or deleted 79 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/