1

I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 certificates that we issued to user, so I know they have both serial number and subject key identifier (SKID). Should I use the serial number or the SKID as a unique ID?

The advantage of SKID is that it's a hash of the public key so it can be independently computed from the certificate. However, the serial number is simply an integer, much easier to deal with.

0

If you only accept certificates issued by you, and you validate that fact, then using the SKID has no security benefit over the serial number. If you use the serial number, and accept self-signed certificates (or any other certificates from CAs who aren't you), an attacker who knows the public key can impersonate users.

Otherwise, there is no difference security-wise. Of course, you'll have to make sure the SKIDs you issue are really unique, and the attacker can't e.g. abuse the fact that your backup signing infrastructure can't doesn't care for duplicates.

As your answer indicates that all certificates are signed by you, you I'd suggest to use SKIDs. You can make your signing infrastructure spare some bits out of your desired int width (e.g. 64 bits), and use those spared bits to store the signer certificate, either on the "storage side", or already with the signers, then you can ensure uniqueness, too.

  • I'm a little bit confused, isn't every public key in a certificate distinct? What's the probability that they repeat? – nullgraph Jul 31 '15 at 5:09
  • you mean that the SKID is distinct? Well, yes, it should be, but you'll have to guarantee that yourself, which depends on your signing infrastructure. If you only e.g. generate the SKID by taking the first 16 bits of some hash depending on all values except the SKID, you'll get in trouble by attackers who generate lots of certificates and find a collision in the range. So best is your infrastructure uses sequential numbers, and a large enough range for the integer, and you build in a failure case if your ID range is full. – user10008 Jul 31 '15 at 5:16
  • I was under the impression that the SKID is computed as SHA1 of public key, and is a built-in extension of x509. I saw from the spec that there are two ways of computing it, but as long as I hand out the certificates, that should be alright, right? – nullgraph Jul 31 '15 at 17:16
  • Oh sorry, you are right, replace "SKID" with "serial number" in above comment. – user10008 Aug 1 '15 at 23:29
  • your attack also works with the SKID since you can derive it however you want (it doesn't have to be the pubkey's hash) – David 天宇 Wong Jul 31 '17 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.