Cross-certification for secure binding of cryptographic systems

1. A computer-implemented method comprising:

receiving, from a first certificate authority at a second certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the first certificate authority, wherein the attribute comprises a hash of a certificate signature associated with the first certificate authority;

generating a cross certificate at the second certificate authority and embedding the attribute unique to the first certificate authority as a certificate extension within the cross certificate;

wherein at least a portion of the cross certificate is signed with a key associated with the second certificate authority;

receiving, from the second certificate authority at the first certificate authority, a second cross certificate request, the second cross certificate request including an attribute unique to the second certificate authority;

generating, at the first certificate authority, a second cross certificate and embedding data including the attribute unique to the second certificate authority as a certificate extension within the second cross certificate;

wherein at least a portion of the second cross certificate is signed with a key associated with the first certificate authority.

2. The computer-implemented method of claim 1 , wherein the first certificate authority and the second certificate authority comprise root certificate authorities.

3. The computer-implemented method of claim 1 , wherein the first certificate authority and the second certificate authority comprise intermediate certificate authorities.

4. The computer-implemented method of claim 3 , further comprising:

prior to generating the cross certificate:

receiving, from a first root certificate authority at a second root certificate authority, a further cross certificate request, the further cross certificate request including an attribute unique to the first root certificate authority; and

generating a further cross certificate and embedding the attribute unique to the first root certificate authority as a certificate extension within the further cross certificate;

wherein at least a portion of the further cross certificate is signed with a key associated with the second root certificate authority.

5. The computer-implemented method of claim 1 , further comprising, based on the cross certificate lacking the embedded attribute, failing validation of the cross certificate.

6. The computer-implemented method of claim 1 , wherein the first certificate authority uses a first key generation algorithm and the second certificate authority utilizes a second key generation algorithm different from the first key generation algorithm.

7. The computer-implemented method of claim 1 , further comprising:

requesting certification of a public key of an end entity at the first certificate authority, the first certificate authority being an issuing certificate authority of the public key of the end entity; and

issuing a certification request from the first certificate authority to the second certificate authority.

8. The computer-implemented method of claim 7 , further comprising:

certifying the public key of the end entity at the second certificate authority.

9. The computer-implemented method of claim 1 , further comprising:

issuing a first end entity certificate to an end entity, the first end entity certificate being associated with the first certificate authority;

issuing a second end entity certificate to the end entity, the second end entity certificate being associated with the second certificate authority, the second end entity certificate including an extension that includes a hash of a signature of the second end entity certificate signed by the second certificate authority.

10. The computer-implemented method of claim 9 , further comprising:

at a verifier, obtaining the first end entity certificate and the second end entity certificate;

verifying the first end entity certificate with the first certificate authority;

computing a hash of a signature of the first end entity certificate; and

comparing the hash of the signature of the first end entity certificate to the hash of a signature of the second end entity certificate to validate the end entity with both the first certificate authority and the second certificate authority.

11. A system comprising:

a first root certificate authority and a second root certificate authority, the first root certificate authority being communicatively connected to the second root certificate authority, and wherein:

the first root certificate authority implements a first digital signature scheme;

the second root certificate authority implements a second digital signature scheme different from the first digital signature scheme;

the first root certificate authority executing instructions to:

receive, from the second root certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the second root certificate authority, wherein the attribute comprises a hash of a certificate signature associated with the first root certificate authority; and

generate a cross certificate and embedding the attribute unique to the second root certificate authority as a certificate extension within the cross certificate, wherein the cross certificate is signed with a key associated with the first root certificate authority;

the second root certificate authority executing instructions to:

receive, from the first root certificate authority, a second cross certificate request, the second cross certificate request including an attribute unique to the first root certificate authority, wherein the attribute comprises a hash of a certificate signature associated with the first root certificate authority; and

generate a second ross certificate and embedding the attribute unique to the first root certificate authority as a certificate extension within the second cross certificate, wherein the second cross certificate is signed with a key associated with the second root certificate authority.

12. The system of claim 11 , further comprising the second root certificate authority.

13. The system of claim 12 , wherein the first root certificate authority is implemented at a first node and the second root certificate authority is implemented at a second node communicatively coupled to the first node.

14. The system of claim 11 , further comprising a first intermediate certificate authority and a second intermediate certificate authority, wherein the first intermediate certificate authority is configured to issue a first intermediate certificate signed by the first root certificate authority and the second intermediate certificate authority is configured to issue a second intermediate certificate signed by the second root certificate authority.

15. The system of claim 14 , wherein the first intermediate certificate authority is configured to issue an intermediate cross certificate to the second intermediate certificate authority by embedding a hash into the cross certificate, the hash being a hash value based on a combination of an intermediate key associated with the first intermediate certificate authority and a signature generated at least in part based on a request from the second intermediate certificate authority including an attribute unique to the second intermediate certificate authority.

16. The system of claim 15 , wherein the second intermediate certificate authority is configured to issue a second intermediate cross certificate complementary to the intermediate cross certificate.