Subject: RE: search for PKCS10 extension

From: "David Cross" <[email-masked]>
Date: Mon, 2 Apr 2001 20:48:55 -0700

This is a sample dump from a PKCS#10 request generated by a Microsoft
client using rhe xenroll.dll control, sorry I don't have a specification
for you.  Here is the items you mentioned:

Attribute[2]: 1.3.6.1.4.1.311.13.2.2 (Enrollment CSP)
    Value[2][0]:
    Unknown Attribute type
    CSP Provider Info
    KeySpec = 1
    Provider = Microsoft Base Cryptographic Provider v1.0 

------------------------------------------------------------------------
----------------------------

PKCS10 Certificate Request:
Version: 1
Subject:
    CN=test

Public Key Algorithm:
    Algorithm ObjectId: 1.2.840.113549.1.1.1  RSA
    Algorithm Parameters:
    05 00                                              ..
Public Key Length: 512 bits
Public Key: UnusedBits = 0
    0000  30 48 02 41 00 e2 c2 87  55 c1 14 1e 83 fe e0 86
    0010  c4 81 30 de 29 20 47 01  a3 5d 10 f0 cf 9f d4 57
    0020  58 40 2b 4a 05 22 83 65  65 7a a1 c1 e1 a7 94 37
    0030  df 7d 08 7d 46 50 f7 73  54 62 14 21 1f 5d 76 93
    0040  fe 32 97 61 e1 02 03 01  00 01
Request Attributes: 3
  3 attributes:

  Attribute[0]: 1.3.6.1.4.1.311.13.2.3 (OS Version)
    Value[0][0]:
        5.1.2462.2

  Attribute[1]: 1.2.840.113549.1.9.14 (Certificate Extensions)
    Value[1][0]:
    Unknown Attribute type
Certificate Extensions: 3
    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Non-Repudiation, Key Encipherment, Data
Encipherment (f0)

    1.2.840.113549.1.9.15: Flags = 0, Length = 29
    SMIME Capabilities
        [1]SMIME Capability
             Object ID=1.2.840.113549.3.2
             Parameters=02 01 38
        [2]SMIME Capability
             Object ID=1.2.840.113549.3.4
             Parameters=02 01 38
        [3]SMIME Capability
             Object ID=1.3.14.3.2.7

    2.5.29.37: Flags = 0, Length = c
    Enhanced Key Usage
        Client Authentication (1.3.6.1.5.5.7.3.2)

  Attribute[2]: 1.3.6.1.4.1.311.13.2.2 (Enrollment CSP)
    Value[2][0]:
    Unknown Attribute type
    CSP Provider Info
    KeySpec = 1
    Provider = Microsoft Base Cryptographic Provider v1.0
    Signature: UnusedBits=0
    0000  27 21 0f 8f 03 85 29 c9  f9 74 c9 d5 76 71 99 df
    0010  0f 68 24 f8 5b 18 62 2a  49 85 e1 fa 8f dd ef 13
    0020  89 f9 a1 52 17 3e ee 7d  04 9f 71 72 ff 81 d7 75
    0030  5b f6 be f4 38 e1 0d 7a  f2 d5 b2 95 93 9a 98 1d
    0040  6a 75 6b b0 3c 9d 14 2e  cf 0f 96 eb a8 24 01 99
    0050  ee 53 78 4f f3 07 7a 10  bd f4 d8 e6 b8 67 58 4a
    0060  b1 cd bf f6 0a 60 8d 07  73 5c 28 b3 f2 4d c5 f6
    0070  5a 83 10 8f 65 36 c3 d6  30 16 96 2c 3d 61 e8 62
    0080  00 00 00 00 00 00 00 00
Signature Algorithm:
    Algorithm ObjectId: 1.2.840.113549.1.1.5  sha1RSA
    Algorithm Parameters:
    05 00                                              ..
Signature: UnusedBits=0
    0000  1b 6b 5c c0 61 6d 7e a0  e5 25 7a 6f 5c 14 90 d9
    0010  d4 77 d3 df 57 ea 19 57  6f ff 89 e5 df 23 8e 86
    0020  be de 34 11 6b cb ee e1  12 53 23 4c 77 5d 6a a8
    0030  00 4f 6f f6 a8 78 d5 d2  1d 3c 38 b8 53 19 6e 3c
Signature matches Public Key
Key Id Hash(sha1): 2d 5a 38 04 29 43 fb cf 50 68 76 b7 56 62 8c ad 12 08
29 ab
CertUtil: -dump command completed successfully.

------------------------------------------------------------------------
----------------------------

Hope this helps,
 
David B. Cross

-----Original Message-----
From: Santoni Adriano [mailto:[email-masked]] 
Sent: Monday, April 02, 2001 3:30 AM
To: 'Martin Szotkowski'
Cc: [email-masked]
Subject: R: search for PKCS10 extension

Martin,

Afaik, there is no "standard" extension to do that. However, Microsoft
defined their own proprietary extension for exactly this purpose, and
that extension usually gets added to the PKCS#10 request if this is
generated via their XENROLL control. The extension has an OID of {1 3 6
1 4 1 311 13 2 2} (aka ???) and identifies a SEQUENCE of 3 items, one of
which is or contains the Unicode name of the CSP used to generate the
keypair.

Btw, it might be interesting to find out what is the inner structure of
this rather obscure Microsoft extension. I'va not been able to find any
mention of it on Microsoft websites.

Adriano

-----Messaggio originale-----
Da: Martin Szotkowski [mailto:[email-masked]]
Inviato: venerdì 30 marzo 2001 9.17
A: [email-masked]
Oggetto: search for PKCS10 extension

I will add into PKCS10 request information about source of private key,
but I don't know if some extension exist or if I must create own.

I search for cases:
1. This information will be CSP Name who generate request
2. This information will be SHA1 over the Secret data on hardware token

thanks Martin