Subject: PKINIT -19 comments

From: Love <[email-masked]>
Date: Sat, 17 Apr 2004 16:13:47 +0200

>    PA-PK-AS-REP ::= CHOICE {
>        dhSignedData            [0] ContentInfo,
>                                    -- Type is SignedData.
>                                    -- Content is KDCDHKeyInfo
>                                    -- (defined below).
>        encKeyPack              [1] ContentInfo,
>                                    -- Type is SignedData.
>                                   -- Content is ReplyKeyPack
>                                    -- (defined below).

In -18, this was the encoded like this

	EnvelopedData(SignedData(ReplyKeyPack))

Now the asn1 comment is just confusing. The text below is descripting the
case that almost made sense before is just now plainly broken.

Below I've rewritten this section, and if accepted, the other two (?)
places should be rewritten in the same style.

There is one problem with the text below, see XXX comment within.

Love

3.2.3.1 KDC Reply - encKeyPack case

If the the client isn't send it Diffie-Hellman public key in AuthPack
clientPublicValue, the KDC generates an encryption key and uses that key to
encrypt the reply to the client.

The generated key to the client is send back using
PA-PK-AS-REP encKeyPack.

The encKeyPack is a ContentInfo structure containing a EnvelopedData
that contains a SignedData that contains a ReplyKeyPack structure.

    ReplyKeyPack ::= SEQUENCE {
        replyKey                [0] EncryptionKey,
        nonce                   [1] UInt32, -- MUST be > 0 --
        ...
    }

To fill in the the encKeyPack field, the following steps are done:

1. The generated key and the used in the request nonce is filled in a
   ReplyKeyPack, and is then DER encoded.

2. The DER encoded string is wrapped by SignedData [CMS], the oid used
   for the type of the wrapped data is id-pkrkeydata. The SignedData
   have at least one signer, the KDC signature.

   If the client left the PA-PK-AS-REQ kdcCert field empty, the KDC
   SHOULD send back the Certificate that is used for the signature in
   SignedData certificates field.

   The SignedData is then DER encoded.

3. The DER encoded SignedData is wrapped by EnvelopedData. Since
   its a SignedData that EnvelopedData is wrapping, id-signedData is
   used as the oid in EnvelopedData EncryptedContentInfo contentType .

   There is at MUST only be one recipient, the recipient that the
   client expressed in the OPTIONAL PA-PK-AS-REQ encryptionCert [ XXXX
   Encryptioncert is NOT SIGNED, THIS IS A PROBLEM ] or certificate
   used to sign the request.

   The EnvelopedData is then DER encoded.

4. The DER encoded EnvelopedData is stored in the encKeyPack, the oid
   used as encKeyPack.contentType is id-envelopedData.