Automatic root key rollover during digital signature verification
View Patent ↗A method for verifying digital signatures in the presence of root key rollover includes issuing a cross-certificate to a rekeyed root certificate, validating the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate, and validating a digital media signature using the cross-certificate and the rekeyed root certificate. The method may also include adding the rekeyed root certificate to an end user's trusted root certificate store. The digital media signature validated via the method may correspond to a program signature. Validating the cross-certificate and the rekeyed root certificate may include verifying certificates within a program's certificate chain. A computer program product and a computer system corresponding to the method are also disclosed.
1. A method for validating digital media signatures, the method comprising:
adding current root certificates for certification authorities to be trusted to a trusted root certificate store;
using a certification authority's public key to issue a cross-certificate to a rekeyed root certificate by signing the rekeyed root certificate's public key with the certification authority's public key, wherein the rekeyed root certificate has the same subject and issuer names as an original trusted certificate of the certification authority;
validating the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate by verifying that a key usage extension and a basic constraints extension for each the cross-certificate and the rekeyed root certificate match a key usage extension and a basic constraints extension for the original trusted root certificate;
adding the rekeyed root certificate to an end user's trusted root certificate store; and
validating a digital media signature using the cross-certificate and the end user's trusted root certificate store.
2. The method of claim 1 , wherein validating the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate comprises verifying a subject name and an issuer name for each the cross-certificate and the rekeyed root certificate match a subject name and an issuer name for the original trusted root certificate.
3. The method of claim 1 , wherein validating the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate comprises verifying that the cross-certificate and the rekeyed root certificate have not expired.
4. The method of claim 1 , wherein validating a digital media signature using the cross-certificate and the rekeyed root certificate comprises using a public key from the rekeyed root certificate to initiate validation of the digital media signature.
5. The method of claim 1 , wherein the digital media signature corresponds to a program signature.
6. A computer program product for validating digital media signatures, the computer program product comprising:
one or more computer readable storage media that are not transitory signals per se and program instructions stored on the one or more computer readable storage media, the program instructions comprising instructions to:
add current root certificates for certification authorities to be trusted to a trusted root certificate store;
use a certification authority's public key to issue a cross-certificate to a rekeyed root certificate by signing the rekeyed root certificate's public key with the certification authority's public key, wherein the rekeyed root certificate has the same subject and issuer names as an original trusted certificate of the certification authority;
validate the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate by verifying that a key usage extension and a basic constraints extension for each the cross-certificate and the rekeyed root certificate match a key usage extension and a basic constraints extension for the original trusted root certificate;
add the rekeyed root certificate to an end user's trusted root certificate store; and
validate a digital media signature using the cross-certificate and the end user's trusted root certificate store.
7. The computer program product of claim 6 , wherein instructions to validate the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate comprise instructions to:
verify a subject name and an issuer name for each the cross-certificate and the rekeyed root certificate match a subject name and an issuer name for the original trusted root certificate.
8. The computer program product of claim 6 , wherein instructions to validate the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate comprise instructions to:
verify that the cross-certificate and the rekeyed root certificate have not expired.
9. The computer program product of claim 6 , wherein instructions to validate a digital media signature using the cross-certificate and the rekeyed root certificate comprise instructions to:
use a public key from the rekeyed root certificate to initiate validation of the digital media signature.
10. The computer program product of claim 6 , wherein the digital media signature corresponds to a program signature.
11. A computer system for validating digital media signatures, the computer program product comprising:
one or more hardware processors;
one or more computer-readable storage media that are not transitory signals per se;
program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising instructions to:
add current root certificates for certification authorities to be trusted to a trusted root certificate store;
use a certification authority's public key to issue a cross-certificate to a rekeyed root certificate by signing the rekeyed root certificate's public key with the certification authority's public key, wherein the rekeyed root certificate has the same subject and issuer names as an original trusted certificate of the certification authority;
validate the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate by verifying that a key usage extension and a basic constraints extension for each the cross-certificate and the rekeyed root certificate match a key usage extension and a basic constraints extension for the original trusted root certificate;
add the rekeyed root certificate to an end user's trusted root certificate store; and
validate a digital media signature using the cross-certificate and the end user's trusted root certificate store.
12. The computer system of claim 11 , wherein instructions to validate the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate comprise instructions to:
verify a subject name and an issuer name for each the cross-certificate and the identified rekeyed root certificate match a subject name and an issuer name for the original trusted root certificate.
13. The computer system of claim 11 , wherein instructions to validate the cross-certificate and the rekeyed root certificate with respect to an original trusted root certificate comprise instructions to:
verify that the cross-certificate and the rekeyed root certificate have not expired.
14. The computer system of claim 11 , wherein instructions to validate a digital media signature using the cross-certificate and the rekeyed root certificate comprise instructions to:
use a public key from the rekeyed root certificate to initiate validation of the digital media signature.