You are viewing a plain text version of this content. The canonical link for it is here.
Posted to fx-dev@ws.apache.org by Christof Soehngen <Ch...@SYRACOM.DE> on 2004/05/28 10:37:58 UTC

Does the use of the same key for encryption and signature pose a security threat?

I was told lately not to use the same (private) key for both encryption and signature. This would create a security leak for cryptographic attacks.
 
As far as I could find out, it is a problem of key management, you want to keep the encryption key as long as possible, so you can always decrypt (even after a long time), but you want to minimize the time a private key exists after it becomes invalid, so noone can abuse it.
 
Does anyone know a mathematical reason besides the key management issue?
 
Problem is, regarding the WS scenario, it would not be sufficient for a client to send the (public part of the) key, the message was signed with, to the server. The server would also need a different public key for encryption. This would make further efforts necessary.
 
Regards,
Christof Soehngen