4

CRL lists the revoked certificates of a CA by sending back to the user the Serial Number of each certificate, nothing related to the public key. I don't know how it works for OCSP.

Is there a technical way on the CA side (beyond the organizational processes) to ensure that the private key used for generating the CSR was not already used in a revoked certificate? Then the idea would be to reject the CSR by indicating that the private key cannot be trusted. This question focuses on RSA or ECC certificates.

2
  • SKs are not trusted, only PKs are. An attacker with a SK cannot get a new certificate because they cannot pass the ownership/identity checks. They can use the key as long as its certificate is not revoked, once revoked the key is useless. If a company keeps reusing a compromised key it will go out of business by social pressure (cfr. DigiNotar). ECC has a single PK for a correctly generated SK, RSA has infinite many but they are unusually large. A CA could implement these checks but no company want to reuse a stolen private key in the first place. Commented Apr 18, 2023 at 10:23
  • There are more issues than stolen SK, there is broken key generation (e.g. the low entropy keys introduced in Debian), it would be nice if CA detected that before emitting a certificate. Commented Apr 18, 2023 at 13:04

2 Answers 2

0

With RSA, each private key has only one public key. A CSR contains the public key which could allow the CA to check which serial numbers have been revoked and reject new CSRs that contain that public key. So technically this is possible, but you'd need to consider how reasonable this is. An individual can create as many private keys as they want.

For more information on why a private key should only have one public key, please see: https://stackoverflow.com/questions/9375044/can-we-have-multiple-public-keys-with-a-single-private-key-for-rsa

3
  • There is no relationship between the public key and the serial number, so the CA should actually store all the public key it has ever seen (in practice a good hash will do) in order to raise an alert in case of public key reuse. Commented Apr 18, 2023 at 12:35
  • Right, there is no relationship. OP asked if there was a way to check if the private key used to generate the CSR wasn't used previously for a revoked certificate. To do this, creating this relationship might be the way to go. Or do you mean that the relationship isn't necessary and storing the public key should be enough?
    – Rohilla
    Commented Apr 18, 2023 at 13:25
  • The later, storing the public key is the way to go IMHO. It would catch some devices with a broken RNG generating the same key often at least. Commented Apr 19, 2023 at 10:17
0

You can by storing hashes of public keys. Recall that private/public key is a 1:1 relationship. You can generate a hash of the public key with openssl req -in csr.txt -noout -pubkey | sha256sum.

me@linux:~ $ openssl req -in csr.txt -noout -pubkey
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhPMown8tbyJKu0YfJFo3
TuJ3NywNsqdVcjdCC01FJlPvCeK0Ur7j0L1WGEbVzl38xzZW92E6OhAoOubcpjxM
yZThL/6PLC9cAxYGwB8ZzG+HS9ogo8BCOA3QVXVPkXl3PPqde/nBWvQpz2xHpkwg
7V6n/V1CTNcPP9MySuDPOVrQCtC9PC8qm8LBX5L0FL4Dy350dEhG6vAJY5U/P9cf
1jYhZypuCRuTjFJ7ON1RP40z+KCnnmSyLih59nijuiHy/gn+AayWdTuYbJBA6hen
GjmD9UxR+bU8u6Z7cPbohuyn88aPw7dbWoaT/CCWtWsKIYo8epbH0nbzx0gUI5wb
zQIDAQAB
-----END PUBLIC KEY-----
me@linux:~ $ openssl req -in csr.txt -noout -pubkey | sha256sum
59c6aa130a480f1139af7ebaa5a1c3fd7e8dec8907bc711a15626de6333f2892  -

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .