Subject: [lamps] Fwd: [pkix] Managing Long-Lived CA certs

From: "Dr. Pala" <[email-masked]>
Date: Mon, 17 Jul 2017 17:21:52 +0200

Hi all,

Would this be an item that the WG would be interested in working on ? It 
should be quite a simple I-D, IMHO.

Cheers,
Max

-------- Forwarded Message --------
Subject: 	[pkix] Managing Long-Lived CA certs
Date: 	Mon, 17 Jul 2017 16:19:44 +0200
From: 	Dr. Pala <[email-masked]>
Organization: 	OpenCA Labs
To: 	[email-masked]

Hi PKIX,

I have a small question for the list regarding long-lived CA 
certificates. Especially in the context of device certificates, we often 
see the use of extra long-lived certificates for Root and Sub CAs (e.g., 
35+ years) combined with limited key sizes (e.g., p256).

Until we have a supported mechanism for reprovisioning devices (...), 
one possible solution for limiting the exposure of the private key would 
be to have a scoped certificate issuance period.

What I am thinking about would be adding an extension that says: "This 
CA can issue certificates from up to 5 years from the validFrom, after 
this, just use it to provide revocation information". This might provide 
some protection in case the CA key is compromised after the initial 5 
years of validity (e.g., certificates issued after that date shall be 
rejected).

Does such extension exists today ? If not, could this be some work for 
LAMPS/SPASM WG ?

Cheers,
Max

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo