Tweeted twitter.com/#!/StackSecurity/status/138623087422869504
3 Improved grammar/spelling
source | link

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background:

In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support for both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption (and vice verse - not able to export the key for signing)... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background

In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background:

In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support for both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption (and vice verse - not able to export the key for signing)... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

2 deleted 88 characters in body
source | link

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background In

In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

Hope you understand my question and that it is answerable. :-) Kind regards, Stefan

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

Hope you understand my question and that it is answerable. :-) Kind regards, Stefan

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background

In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

1
source | link

Two certificates on smart card

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

Hope you understand my question and that it is answerable. :-) Kind regards, Stefan