Using a digital certificate with multiple cryptosystems

A computer system comprising:

• a data processing apparatus;
• and
• a non-transitory computer-readable medium storing instructions that are operable when executed by the data processing apparatus to perform operations comprising:
• receiving, at a node in a network-based communication system, a certificate request comprising a first public key of an entity, the first public key being associated with a first cryptosystem;
• using a first private key of a certificate authority to generate a first digital signature based on information in the certificate request, the first private key of the certificate authority being associated with the first cryptosystem;
• and
• producing a digital certificate comprising:
• a public key field comprising the first public key of the entity;
• a signature value field comprising the first digital signature;
• and
• an extension comprising at least one of:
• a second public key of the entity, the second public key being associated with a second cryptosystem;
• or
• a second digital signature generated using a second private key of the certificate authority based on information in the certificate request, the second private key of the certificate authority being associated with a second cryptosystem;
• wherein the first cryptosystem defines a set of first cryptographic protocols and parameters, and the second cryptosystem defines a set of second cryptographic protocols and parameters.

A cryptography method comprising:

• receiving, at a node in a network-based communication system, a digital certificate comprising:
• a public key field comprising a first public key of an entity, the first public key of the entity being associated with a first cryptosystem;
• a signature value field comprising a first digital signature of a certificate authority, the first digital signature being associated with the first cryptosystem;
• and
• an extension comprising at least one of:
• a second public key of the entity, the second public key being associated with a second cryptosystem;
• or
• a second digital signature of a certificate authority, the second digital signature being associated with the second cryptosystem;
• and
• by operation of one or more processors, generating a certificate digest based at least in part on the extension;
• and
• using the certificate digest and a public key of the certificate authority to verify the first digital signature of the certificate authority or the second digital signature of the certificate authority;
• wherein the first cryptosystem defines a set of first cryptographic protocols and parameters, and the second cryptosystem defines a set of second cryptographic protocols and parameters.

A computer system comprising:

• a data processing apparatus;
• and
• a non-transitory computer-readable medium storing instructions that are operable when executed by the data processing apparatus to perform operations comprising:
• receiving, at a node in a network-based communication system, a digital certificate comprising:
• a public key field comprising a first public key of an entity, the first public key of the entity being associated with a first cryptosystem;
• a signature value field comprising a first digital signature of a certificate authority, the first digital signature being associated with the first cryptosystem;
• and
• an extension comprising at least one of:
• a second public key of the entity, the second public key being associated with a second cryptosystem;
• or
• a second digital signature of a certificate authority, the second digital signature being associated with the second cryptosystem;
• and
• generating a certificate digest based at least in part on the extension;
• and
• using the certificate digest and a public key of the certificate authority to verify the first digital signature of the certificate authority or the second digital signature of the certificate authority;
• wherein the first cryptosystem defines a set of first cryptographic protocols and parameters, and the second cryptosystem defines a set of second cryptographic protocols and parameters.