Re: Certificate serial number generation algorithms

2004-10-19 Thread Joerg Schneider
Richard Levitte - VMS Whacker schrieb: Variants I've heard of are: [...] - Another option that I've seen is to use a counter and encrypt it with a block chipher using a fixed key. This guarantees uniqueness (because encryption is bijective) while concealing the counter and using less bytes than

Re: Certificate serial number generation algorithms

2004-10-11 Thread Richard Levitte - VMS Whacker
In message <[EMAIL PROTECTED]> on Sun, 10 Oct 2004 18:16:21 -0700, Eric Rescorla <[EMAIL PROTECTED]> said: ekr> Does anyone know the details of the certificate generation ekr> algorithms used by various CAs? Variants I've heard of are: - A simple counter starting at 0 (well, actually, I know t

Re: Certificate serial number generation algorithms

2004-10-11 Thread Peter Gutmann
Eric Rescorla <[EMAIL PROTECTED]> writes: >In particular, Verisign's is very long and I seem to remember someone telling >me it was a hach but I don't recall the details... It's just a SHA-1 hash. Many CAs use this to make traffic analysis of how many (or few) certificates they're issuing imposs

Certificate serial number generation algorithms

2004-10-11 Thread Eric Rescorla
Does anyone know the details of the certificate generation algorithms used by various CAs? In particular, Verisign's is very long and I seem to remember someone telling me it was a hach but I don't recall the details... Thanks, -Ekr --