Subject: Encryption of Private Keys in CRMF and CMP

From: [email-masked]
Date: Thu, 25 May 2000 15:41:47 -0400

Carlisle,

In Section 6.4 of RFC 2511 on CRMF, it is indicated that the EncryptedValue
field "encValue" is a BIT STRING, however I could not find any further
detail in RFC 2511 nor in RFC 2510bis, which also use this syntax, about how
to create this encrypted value (restricted, in RFC 2510bis, to be either
private keys or certificates).

Am I missing something?

I understand that RFC 2511 EncryptedValue field "symmAlg" tells me the
symmetric algorithm that was used to encrypt a private key value and that
Appendix B2 of RFC 2510bis mandates that conforming implementations MUST
support 3-DES (3-key-EDE, CBC mode) for this. However, this does not tell me
what exactly is being encrypted.

Is it a type "PrivateKeyInfo" from Section 6 of PKCS#8 or a type
"RSAPrivateKey" from Section 11.1.2 of PKCS#1 for a RSA private key since
RFC 2511 EncryptedValue field "intendedAlg" already tell me the intended
algorithm for which the private key will be used for? 

Thanks in advance for any help.

Francois
___________________________________
Francois Rousseau
Director of Standards and Conformance
Chrysalis-ITS
1688 Woodward Drive
Ottawa, Ontario, CANADA, K2C 3R7
[email-masked]      Tel. (613) 723-5076 ext. 419
http://www.chrysalis-its.com     Fax. (613) 723-5078