Netscape Extensions for User Key Generation

Navigator 3.0 Version

Send comments to:

Key Generation

A new HTML tag has been added to facilitate generation of key material, and submission of the public key as part of an HTML form. This mechanism is designed for use in WWW based certificate management systems. It is expected that the <KEYGEN> tag will be used in an HTML form along with other information needed to construct a certificate request, and that the result of the process will be a signed certificate.

The new tag is:

<KEYGEN NAME="name" CHALLENGE="challenge string">

The KEYGEN tag is only valid within an HTML form. It will cause some sort of selection to be presented to the user for selecting key size. The UI for the selection may be a menu, radio buttons, or possibly something else. The Navigator presents several possible key sizes. Currently the Export version will only allow 512 bit, while the US version will give the user the option of 512 bit, 768 bit, and 1024 bit.

When the submit button is pressed, a key pair of the selected size is generated. The private key is encrypted and stored in the local key database.

PublicKeyAndChallenge ::= SEQUENCE {
    spki SubjectPublicKeyInfo,
    challenge IA5STRING

SignedPublicKeyAndChallenge ::= SEQUENCE {
    publicKeyAndChallenge PublicKeyAndChallenge,
    signatureAlgorithm AlgorithmIdentifier,
    signature BIT STRING
The public key and challenge string are DER encoded as PublicKeyAndChallenge, and then digitally signed with the private key to produce a SignedPublicKeyAndChallenge. The SignedPublicKeyAndChallenge is base64 encoded, and the ascii data is finally submitted to the server as the value of a form name/value pair, where the name is name as specified by the NAME= attribute of the KEYGEN tag. If no challenge string is provided, then it will be encoded as a IA5STRING of length zero.

Here is an example form submission as it would be delivered to a cgi program by the http server:


Certificate Extensions and Downloading

For more infomation on Netscape supported Certificate Extensions, please see the document Netscape Certificate Extensions Specification.

For more infomation on downloading certificates into Netscape Navigator in response to the <KEYGEN> tag, please see the document Netscape Certificate Download Specification.