Two certificates on smart card

Question

I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?

Background:

In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.

My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support for both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption (and vice verse - not able to export the key for signing)... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...

Answer 1

An explanation on Wikipedia gives the following reason. In many countries digitally signing a document is the same as a hand written signature (i.e., legally binding). So what if you want to hold an encrypted chat session, but don't want it to be legally binding. You could still use only one key-pair and not be signing, but you are safer if you have two separate key-pairs.

Another, more theoretical issue to think about. Look at RSA. How do you sign something. You take M^d mod N where d is your private key. How do you decrypt something? You take C^d mod N. So what is you were willing to decrypt anything I sent to you and tell me the result. I could send you C="I owe you $1,000,000" (note that this is really a plain text). You'd do C^d mod N and tell me the result. What I'd have is your digital signature on the message "I owe you $1,000,000".

Answer 2

You want to keep signature keys apart from encryption keys; this boils down to consequences of key loss, and key backups. You don't want a backup of signature keys, because this tends to strip them of their potential legal value; but you do want a backup of encryption keys, because loss of an encryption key implies loss of all the data which has been encrypted with that key. See this answer for details.

A signature key and an authentication key could be merged, though, because "authentication" really means, here, a signature on a challenge value. Keeping them apart from each other makes "sense" (in a bureaucratic way) if the corresponding certificates are issued by two distinct CA, and neither of them would accept being regarded as a sub-CA for the other. Another reason would be an inflexible set of regulations that insist on the "one usage per key" mantra, and considers authentication to be distinct from signatures.

Modern smart cards have room for many private keys (e.g. I am using this type of card at work, and you can put 30 private keys in such a beast), so there is little harm done in having two key pairs and two certificates, even if it was not strictly necessary.