Subject: pkinit comment

From: Love <[email-masked]>
Date: Wed, 12 Nov 2003 17:36:31 +0100

I commented on the after the pkinit slides at ietf58.

I doesn't like how pkinit pulls in CMS, and following that X509.

PKINIT requires the implemention parse the whole asn1 blob. It might not be
so that X509/CMS implemention uses the same internal asn1 datastructures.

Currently there are several options for the krb implemetion is currently
(as I see it) are:

interesting/strange use of ANY
use x509 parser
implement x509 with its own parser
convert the the krb asn1 parser to the x509 parser internal format

I propose to encapsulate CMS/X509 data in OCTET STRINGs.

That said, since I've already implemeted the first option for the pkinit
patch for heimdal. I don't mind rewritting that.

Love