Subject: PKINIT-22: Pkekuoid

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 24 Jan 2005 09:39:49 -0800

In a separate thread David Cross brought up the issue: Microsoft
smartcard logon certificates currently MUST contain the OID
1.3.6.1.4.1.311.20.2.2.

For app compat reasons, we argue that this OID should be added PKINIT.
Any objections?

-- Larry

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 24 Jan 2005 13:22:47 -0500

> smartcard logon certificates currently MUST contain the OID

What object does this OID name?
What would you want PKINIT to say about this OID?

Reading David's message, I went back and reviewed the relevant text.
It seems that the ASN.1 module defines

       id-pkekuoid  OBJECT IDENTIFIER  ::= { id-pkinit 4 }
       id-pkkdcekuoid  OBJECT IDENTIFIER  ::= { id-pkinit 5 }

The text mentions id-pkekuoid only in the context of an example, and does 
not describe object it names.  There is no mention of id-pkkdcekuoid other 
than its definition in the module.  If PKINIT is going to define these 
OID's, there needs to be normative text describing their usage and 
semantics.

With regard to defining of 1.3.6.1.4.1.311.20.2.2 in PKINIT, you should 
pursue this only if you are trying to standardize its meaning and usage, 
including ceding change control over its meaning to the IETF.  You will 
need to describe its usage and semantics, and you will need a working group 
consensus (not just lack of objection) to add such a definition to PKINIT.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Mon, 24 Jan 2005 18:08:27 -0500

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> In a separate thread David Cross brought up the
    Liqiang(Larry)> issue: Microsoft smartcard logon certificates
    Liqiang(Larry)> currently MUST contain the OID
    Liqiang(Larry)> 1.3.6.1.4.1.311.20.2.2.

    Liqiang(Larry)> For app compat reasons, we argue that this OID
    Liqiang(Larry)> should be added PKINIT.  Any objections?

As a CMS encryption OID?  Or for something else?