The big advantage of implicit certificate is their small size and fast processing. This article presents a way how to compute implicit certificates.

In the end Alice is able to derive both her public and private key ($\alpha$, $Q_A$).

  1. Does this mean that the usage of implicit certificates implies the generation of a new key pair each time such a certificate is issued? Traditional explicit certificates (e.g. X.509) can be issued unlimited often for the same public key.

  2. How do you prevent somebody else to derive Alice's private key? I don't see any secret information that is only possessed by Alice. Initially, I thought this was $\alpha$, but apparently this random integer is send in plain text to the CA. Even if it was encrypted, the CA would know $\alpha$ and consequently Alice's private key.


1 Answer 1

  1. Yes, the certificate $cert$ and the private key are linked. For $cert' \ne cert$, the private key will be different (except for a negligible collision probability).

  2. Alice's secret $\alpha$ is known by herself only (only $\alpha G$ is sent in the first step of the protocol). This prevents a third party from deriving her private key.

  • $\begingroup$ I see. The crucial part is that only Alice knows alpha. Thanks. $\endgroup$
    – null
    Jun 1, 2018 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.