Connected: An Internet Encyclopedia
4.1.1 Types of Keys
Up:
Connected: An Internet Encyclopedia
Up:
Requests For Comments
Up:
RFC 1421
Up:
4. Processing of Messages
Up:
4.1 Message Processing Overview
Prev: 4.1 Message Processing Overview
Next: 4.1.2 Processing Procedures
4.1.1 Types of Keys
4.1.1 Types of Keys
A two-level keying hierarchy is used to support PEM transmission:
- Data Encrypting Keys (DEKs) are used for encryption of
message text and (with certain choices among a set of
alternative algorithms) for computation of message integrity
check (MIC) quantities. In the asymmetric key management
environment, DEKs are also used to encrypt the signed
representations of MICs in PEM messages to which
confidentiality has been applied. DEKs are generated
individually for each transmitted message; no
predistribution of DEKs is needed to support PEM
transmission.
- Interchange Keys (IKs) are used to encrypt DEKs for
transmission within messages. Ordinarily, the same IK will
be used for all messages sent from a given originator to a
given recipient over a period of time. Each transmitted
message includes a representation of the DEK(s) used for
message encryption and/or MIC computation, encrypted under
an individual IK per named recipient. The representation is
associated with Originator-ID and Recipient-ID fields
(defined in different forms so as to distinguish symmetric
from asymmetric cases), which allow each individual
recipient to identify the IK used to encrypt DEKs and/or
MICs for that recipient's use. Given an appropriate IK, a
recipient can decrypt the corresponding transmitted DEK
representation, yielding the DEK required for message text
decryption and/or MIC validation. The definition of an IK
differs depending on whether symmetric or asymmetric
cryptography is used for DEK encryption:
- When symmetric cryptography is used for DEK
encryption, an IK is a single symmetric key shared
between an originator and a recipient. In this
case, the same IK is used to encrypt MICs as well
as DEKs for transmission. Version/expiration
information and IA identification associated with
the originator and with the recipient must be
concatenated in order to fully qualify a symmetric
IK.
- When asymmetric cryptography is used, the IK
component used for DEK encryption is the public
component [8] of the recipient. The IK component
used for MIC encryption is the private component of
the originator, and therefore only one encrypted
MIC representation need be included per message,
rather than one per recipient. Each of these IK
components can be fully qualified in a Recipient-ID
or Originator-ID field, respectively.
Alternatively, an originator's IK component may be
determined from a certificate carried in an
"Originator-Certificate:" field.
Next: 4.1.2 Processing Procedures
Connected: An Internet Encyclopedia
4.1.1 Types of Keys