A Public key is certified by a Trusted Certifying authority, to ensure the integrity of the key and authenticity of the entity who claims to have the corresponding private key.

In this Public Key Certificates, What are Implicit and Explicit Certificates?


A certificate establishes a link between an identity and a public key; the link is "guaranteed" by a Certification Authority with some sort of digital signature or another similar cryptographic binding.

The Wikipedia page on "implicit certificates" (pointed to by @Clayton) describes a concept where the public key algorithm is such that the public key, the key owner name, and the signature from the CA are somehow conflated into a single lightweight element. This concept seems to have emerged from the ECQV algorithm, and "implicit certificate" was coined as a sales pitch for that algorithm. Indeed, you can find the (slightly marketing toned) description from Certicom. It seems to be (possibly) subject to a host of patents (e.g. this one).

Though the concept is generic, I am aware of only one actual implementation, which is ECQV. It is not standardized and deployed yet.

In ECQV, the mechanics of the algorithm contrive to store into a single element both the public key and the sort-of-signature from the CA, while the element is no larger than the public key alone. A system trying to use the implicit certificate for a given user needs three elements:

  • the purported key owner identity;
  • the implicit certificate for that owner;
  • the CA public key;

and the ECQV algorithm takes all three elements to output the user's public key. This is implicit in that it is not known yet whether the certificate really exist; i.e. given an implicit certificate C and the CA public key P, the ECQV algorithm says: if the certificate C is owned by user U, then the public key of U is K. All the "implicit" resides in the "if".

A roughly similar concept, but more extreme, is identity-based cryptography. In ID-based crypto, more mathematics are thrown at the problem (pairings on elliptic curves...) so as to achieve an even better result: removal of the certificate. The certificate is so implicit that it no longer needs to exist at all. With ID-based cryptography, the user's identity is his public key. ID-based crypto is "better" than implicit certificates because it allows public key usage out of the blue. Consider for instance the problem of sending an encrypted email to somebody (let's call him Bob):

  • With classical (say "explicit") certificates, you have to first get Bob's certificate. E.g. Bob sends it to you (traditionally with a signed email) or your software finds it in some directory.
  • With implicit certificates, you still have to get Bob's certificate. It is shorter, thus "more efficient", but you need it.
  • With ID-based crypto, you don't need Bob's certificate. You already have it: it is Bob's name, i.e. "Bob". This is sufficient for you to encrypt and send the email.

It seems to me that the implicit certificate concept, i.e. ECQV, has trouble finding some market share; it is squeezed between "normal" certificates, over which ECQV only offers some perceived performance advantage (which, more often that not, has no relevance whatsoever), and ID-based cryptography, which offers some really structural advantages.

(It has been reported that Certicom and other patent owners still succeed in pushing their algorithms in some standardization committees through intense lobbying. I have not witnessed such things myself, though.)

  • Is Idemix and UProve an example of Identity Certificates you describe? I'm asking so I can grasp the structural advantages. – goodguys_activate Jun 23 '14 at 23:46
  • Idemix and UProve are something else. Identity-based cryptography is when you are perfectly aware of the identity of the key owner, and want to use it as the public key itself. Idemix and UProve are for situation where you want to use the public key while not knowing the actual identity of the key owner. – Thomas Pornin Jun 24 '14 at 11:28

Explicit Certificates

Most PKI systems use Explicit Certificates. That is,

Conventional explicit certificates are made up of three parts: identification data, a public key and a digital signature which binds the public key to the user’s identification data (ID). The digital certificate is created by a trusted third party and its signature can be independently verified by anyone in the network. The public key, ID and digital signature are distinct data elements which make the up the physical size of the certificate. "Implicit certificate", Wiki {emphasis mine}

The certificate is said to be explicit because it contains the digital signature of the Certificate Authority (CA) that binds the public key to the identification data (ID). When the signature on an explicit certificate is validated, we know that the person described by the ID will hold the corresponding private key and that he/she will be the ONLY person to have that private key.

Implicit Certificates

In PKI, implicit certificates are a variant system that take up considerably less space (and are therefore useful in constrained environments). They are still comprised of the 3 main elements/parts (ID, public key, digital signature). However, these parts are compressed into the same space as the public key alone (Wiki uses the phrase super imposed). This mathematical translation/compression introduces some liabilities and has these unique features:

  1. There is no explicit validation of the CA
  2. The public key is calculated from the implicit certificate
  3. We can't immediately know if the public key is valid or even if it has a corresponding private key

thanks to @Thomas Pornin, he let the figure much clearer to me.

here add some comments on the ID based certificate system and implicit certificate system.

When A wants to send message to a particular destination, let's say B. Then, ID based certificate system let A can directly speak to B with confidential protection, by using B's ID as his public key.

When A wants to broadcast to a lot of people and showing his authentication of his ID, then ID based system don't work. Implicit certificate works. A can use his implicit cert plus his ID to claim he is a authenticated one.

in IEEE 1609.2, which is cited as national standard by US gov in v2x system, implicit cert is the core tech. v2x system needs broadcasting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.