Subject: PKINIT -19 comments

From: Love <[email-masked]>
Date: Mon, 19 Apr 2004 20:19:35 +0200

for what encryptionCert used ?

---

From: Love <[email-masked]>
Date: Mon, 19 Apr 2004 20:18:42 +0200

"Eric Rosenfeld" <[email-masked]> writes:

> Love,
>
> I sent out an email a few days ago indicating this error was not fixed
> in PKINIT-19. I proposed the following change to address it:
>
> Section 3.2.3 "KDC Reply" - In the ASN.1 definition of PA-PK-AS-REP -
> Change "-- Type is SignedData." to "-- Type is EnvelopedData.". Change
> "-- Content is ReplyKeyPack" to "-- Content is SignedData (over
> ReplyKeyPack)".
>
> Given this change to the ASN.1 comment, do you still believe your
> rewritten instructions are necessary?

Yes, I find the instructions barely understandable and incomplete.

For example is uses the field encryptedContentType, there is no field
encryptedContentType in EnvelopedData, its EnvelopedData
EncryptedContentInfo contentType. 

It doesn't specify the encoding used.

With what key should the EnvelopedData be wrapped with ? Given that
encryptionCert is outside AuthPack, I can only assume its the public key
that the client used to authenticate with.

At least "3.2.3.  KDC Reply" should be split up into two subsections.

3.2.3.1 KDC Reply - dhSignedData case
3.2.3.2 KDC Reply - encKeyPack case

Love