Skip to main content
added 615 characters in body
Source Link

I was wondering whether a CA has different private keys to sign certificates with?

In general, no. There is one key pair - and thus private key - per certificate. Certificates can be rolled over to use a new key pair of course. Furthermore, in general, a CA manages multiple certificates for different purposes. The CA may also have different certificates for different signature algorithms, possibly to cover the same purpose (e.g. RSA and ECDSA).

Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same private key? Does this risk exist?

Not from an algorithm point of view. RSA and ECDSA are secure to sign many documents or certificates for that matter. ECDSA is vulnerable if the random number generator is compromised though. All the more reason to use a well vetted implementation with a good DRBG, preferably in FIPS or CC certified hardware.


As other have mentioned, most of the certificate issuance is performed by intermediate CA certificates. That means that the private key of the root certificate is not directly accessible to attackers. If an intermediate is found to be compromised (detecting compromise is a topic all in itself) then the root can be used to revoke the intermediate certificate and issue a new one, with a different private key.


Of course, when signing large numbers of certificates, there may be procedural hazards. The CA is still supposed to validate that it signs certificates for the right entities. Furthermore it should for instance resist pressure to generate the key pair for clients at the location of the CA.

Neither of the above was handled well at DigiNotar to name just one example. But that has little to do with the signature algorithms by themselves.

I was wondering whether a CA has different private keys to sign certificates with?

In general, no. There is one key pair - and thus private key - per certificate. Certificates can be rolled over to use a new key pair of course. Furthermore, in general, a CA manages multiple certificates for different purposes. The CA may also have different certificates for different signature algorithms, possibly to cover the same purpose (e.g. RSA and ECDSA).

Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same private key? Does this risk exist?

Not from an algorithm point of view. RSA and ECDSA are secure to sign many documents or certificates for that matter.


Of course, when signing large numbers of certificates, there may be procedural hazards. The CA is still supposed to validate that it signs certificates for the right entities. Furthermore it should for instance resist pressure to generate the key pair for clients at the location of the CA.

Neither of the above was handled well at DigiNotar to name just one example. But that has little to do with the signature algorithms by themselves.

I was wondering whether a CA has different private keys to sign certificates with?

In general, no. There is one key pair - and thus private key - per certificate. Certificates can be rolled over to use a new key pair of course. Furthermore, in general, a CA manages multiple certificates for different purposes. The CA may also have different certificates for different signature algorithms, possibly to cover the same purpose (e.g. RSA and ECDSA).

Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same private key? Does this risk exist?

Not from an algorithm point of view. RSA and ECDSA are secure to sign many documents or certificates for that matter. ECDSA is vulnerable if the random number generator is compromised though. All the more reason to use a well vetted implementation with a good DRBG, preferably in FIPS or CC certified hardware.


As other have mentioned, most of the certificate issuance is performed by intermediate CA certificates. That means that the private key of the root certificate is not directly accessible to attackers. If an intermediate is found to be compromised (detecting compromise is a topic all in itself) then the root can be used to revoke the intermediate certificate and issue a new one, with a different private key.


Of course, when signing large numbers of certificates, there may be procedural hazards. The CA is still supposed to validate that it signs certificates for the right entities. Furthermore it should for instance resist pressure to generate the key pair for clients at the location of the CA.

Neither of the above was handled well at DigiNotar to name just one example. But that has little to do with the signature algorithms by themselves.

Source Link

I was wondering whether a CA has different private keys to sign certificates with?

In general, no. There is one key pair - and thus private key - per certificate. Certificates can be rolled over to use a new key pair of course. Furthermore, in general, a CA manages multiple certificates for different purposes. The CA may also have different certificates for different signature algorithms, possibly to cover the same purpose (e.g. RSA and ECDSA).

Is there a risk of crypto-analysis (or something similar) when a CA signs thousands of certificates with the same private key? Does this risk exist?

Not from an algorithm point of view. RSA and ECDSA are secure to sign many documents or certificates for that matter.


Of course, when signing large numbers of certificates, there may be procedural hazards. The CA is still supposed to validate that it signs certificates for the right entities. Furthermore it should for instance resist pressure to generate the key pair for clients at the location of the CA.

Neither of the above was handled well at DigiNotar to name just one example. But that has little to do with the signature algorithms by themselves.