Cross-certification for secure binding of cryptographic systems

1. A computer-implemented method comprising:

receiving, from a first certificate authority at a second certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the first certificate authority;

generating, at the second certificate authority, a cross certificate and embedding the attribute unique to the first certificate authority as a certificate extension within the cross certificate;

signing the cross certificate with a key associated with the second certificate authority;

sending, from the second certificate authority to the first certificate authority, a second cross certificate request including an attribute unique to the second certificate authority; and

receiving a second cross certificate having embedded therein the attribute unique to the second certificate authority as a certificate extension within the second cross certificate, the second cross certificate being signed with a key associated with the first certificate authority.

2. The computer-implemented method of claim 1 , wherein the attribute comprises a hash of a signature of a certificate associated with the first certificate authority.

3. The computer-implemented method of claim 2 , wherein signing the cross certificate includes calculating a signature at the second certificate authority using the attribute received as part of the cross certificate request.

4. The computer-implemented method of claim 1 , further comprising:

at the first certificate authority, validating the cross certificate by:

recalculating, after the cross certificate was created, a hash of a signature of the certificate associated with the first certificate authority; and

comparing the recalculated hash to the attribute included in the cross certificate.

5. The computer-implemented method of claim 1 , wherein the first certificate authority and the second certificate authority comprise root certificate authorities.

6. The computer-implemented method of claim 1 , wherein the first certificate authority and the second certificate authority comprise intermediate certificate authorities.

7. The computer-implemented method of claim 1 , further comprising:

receiving, from the second certificate authority at the first certificate authority, the second cross certificate request;

generating, at the first certificate authority, the second cross certificate and embedding the attribute unique to the second certificate authority as the certificate extension within the second cross certificate; and

signing the second cross certificate with the key associated with the first certificate authority.

8. The computer-implemented method of claim 1 , wherein the first certificate authority uses a first key generation algorithm and the second certificate authority utilizes a second key generation algorithm different from the first key generation algorithm.

9. The computer-implemented method of claim 1 , further comprising:

requesting certification of a public key of an end entity at the first certificate authority, the first certificate authority being an issuing certificate authority of the public key of the end entity; and

issuing a certification request from the first certificate authority to the second certificate authority.

10. The computer-implemented method of claim 9 , further comprising:

certifying the public key of the end entity at the second certificate authority.

11. The computer-implemented method of claim 1 , further comprising:

issuing a first end entity certificate to an end entity, the first end entity certificate being associated with the first certificate authority;

issuing a second end entity certificate to the end entity, the second end entity certificate being associated with the second certificate authority, the second end entity certificate including an extension that includes a hash of a signature of the second end entity certificate signed by the second certificate authority.

12. The computer-implemented method of claim 11 , further comprising:

at a verifier, obtaining the first end entity certificate and the second end entity certificate;

verifying the first end entity certificate with the first certificate authority;

computing a hash of a signature of the first end entity certificate; and

comparing the hash of the signature of the first end entity certificate to the hash of a signature of the second end entity certificate to validate the end entity with both the first certificate authority and the second certificate authority.

13. A system comprising:

a first root certificate authority implementing a first digital signature scheme;

a second root certificate authority implementing a second digital signature scheme different from the first digital signature scheme and communicatively connected to the first root certificate authority;

the first root certificate authority executing instructions to:

calculate a hash of a signature of a certificate associated with the first root certificate authority;

generate, at the first root certificate authority, a cross certificate request including an attribute unique to the first root certificate authority, the attribute including the hash;

receive a cross certificate including the hash as a certificate extension within the cross certificate; and

the second root certificate authority executing instructions to:

calculate a hash of a signature of a second certificate associated with the second certificate authority;

generate, at the second root certificate authority, a cross certificate request including a second attribute unique to the second root certificate authority, the second attribute including the hash of the signature of the second certificate; and

receive a second cross certificate including the second hash as a certificate extension within the second cross certificate.

14. The system of claim 13 , wherein the first root certificate authority further executes instructions to validate the cross certificate by:

recalculating, after the cross certificate was created, a hash of the signature of the certificate associated with the first certificate authority; and

comparing the recalculated hash to the attribute included in the cross certificate.

15. The system of claim 14 , wherein the first certificate authority is implemented at a first node and the second root certificate authority is implemented at a second node communicatively coupled to the first node.

16. The system of claim 15 , further comprising a first intermediate certificate authority and a second intermediate certificate authority, wherein the first intermediate certificate authority is configured to issue a first intermediate certificate signed by the first root certificate authority and the second intermediate certificate authority is configured to issue a second intermediate certificate signed by the second root certificate authority.

17. The system of claim 16 , wherein the second intermediate certificate authority is configured to issue a second intermediate cross certificate complementary to the first intermediate cross certificate.

18. A computer-implemented method comprising:

at a first certificate authority:

receiving, from a second certificate authority at the first certificate authority, a cross certificate request, the cross certificate request including an attribute unique to the second certificate authority;

generating, at the first certificate authority, a first cross certificate and embedding the attribute unique to the second certificate authority as a certificate extension within the first cross certificate; and

signing the first cross certificate with a key associated with the first certificate authority; and

at the second certificate authority:

receiving, from the first certificate authority, a second cross certificate request, the second cross certificate request including an attribute unique to the first certificate authority;

generating, at the second certificate authority, a second cross certificate and embedding the attribute unique to the first certificate authority as a certificate extension within the second cross certificate; and

signing the second cross certificate with a key associated with the second certificate authority.

19. The computer-implemented method of claim 18 , further comprising:

at the first certificate authority, validating the first cross certificate by:

recalculating, after the first cross certificate was created, a hash of the signature of the certificate associated with the first certificate authority; and

comparing the recalculated hash to the attribute unique to the second certificate authority included in the first cross certificate; and

at the second certificate authority, validating the second cross certificate by:

recalculating, after the second cross certificate was created, a second hash of the signature of the certificate associated with the second certificate authority; and

comparing the recalculated second hash to the attribute unique to the first certificate authority included in the second cross certificate.