Key derivation with implicit certificates

Question

The big advantage of implicit certificate is their small size and fast processing. This article presents a way how to compute implicit certificates.

In the end Alice is able to derive both her public and private key ($\alpha$, $Q_A$).

1. Does this mean that the usage of implicit certificates implies the generation of a new key pair each time such a certificate is issued? Traditional explicit certificates (e.g. X.509) can be issued unlimited often for the same public key.

2. How do you prevent somebody else to derive Alice's private key? I don't see any secret information that is only possessed by Alice. Initially, I thought this was $\alpha$, but apparently this random integer is send in plain text to the CA. Even if it was encrypted, the CA would know $\alpha$ and consequently Alice's private key.

Answer 1

1. Yes, the certificate $cert$ and the private key are linked. For $cert' \ne cert$, the private key will be different (except for a negligible collision probability).

2. Alice's secret $\alpha$ is known by herself only (only $\alpha G$ is sent in the first step of the protocol). This prevents a third party from deriving her private key.