2
$\begingroup$

I am trying to sign certificate (X509) using secret sharing. That is shareholders combine their signatures to produce the final signature which will be in this case the signed certificate. However practically from my understanding only one entity can sign a certificate. Therefore I want to know:

  1. which entities or data of the x509certificate are actually taken as input to the signing algorithm?
  2. Ideally I want this data to be signed by the shareholders and then the final combination will be passed to the X509certificate as valid signature.
  3. Is this possible?
  4. How could it done?
  5. If not are they other alternatives?
Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

I'm not quite sure if I understand you correctly.

As far as I understand it, you want to produce a threshold signature on the hash value of an X.509 certificate. It is not sure if you require a distribute key generation of the private key, or you are in possession of the signing key and distribute shares of the key to all stakeholders.

1) Actually, in case of X.509 certificates you sign the hash value of the certificate fields.

2&3) Yes this is possible by using any threshold signature and using the hash-then-sign paradigm. You may look here for a related question.

4) Either run a distributed key generation or generate the keypair for the signature scheme and distribute the shares of the private key to the stakeholders (put the public key in your (self signed) CA cert). Then, to sign an X.509 certificate, compute the hash value and run the distributed signing algorithm on it. Integrate the resulting signature in the X.509 certificate.

Improve this answer
$\endgroup$
2
  • $\begingroup$ DrLecter thank you the answer. you have answered a good part of my question. but the other problem as I stated in my second question is, how to do this integration of the resulting signature into X509Certificate. do you have any idea on that. in java for instance the X509Certificate has no such function to do the integration. so I am pretty stacked there $\endgroup$
    – eskoba
    Commented Nov 8, 2013 at 13:32
  • $\begingroup$ I did not have in mind an implementation and we do not deal with specific implementation issues here (you may ask that at stackoverflow). Nevertheless, when for instance using bouncycastle that should be not too hard to implement. $\endgroup$
    – DrLecter
    Commented Nov 8, 2013 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.