Subject: Encryption Cert OID

From: Eric Norman <[email-masked]>
Date: Mon, 8 Oct 2001 21:04:36 -0500 (CDT)

There's an OID that seems like it should appear in
http://www.imc.org/ietf-smime/other-smime-oids.asn

It's an OID that's used by Outlook Express to include the
senders preferred encryption key among the bunch of
certificates that are sent in a PKCS7 signedData structure.
The OID is 1.3.6.1.4.1.311.16.4 (seems to be in Microsoft's
arc).  It is used as an authenticated attribute; the idea
seems to be the same as SMIMEEncryptionKeyPreference
(OID = 1.2.840.113549.1.9.16.2.11).  The syntax is sligtly
different; it "points to" the actual certificate with only
IssuerAndSerialNumber; i.e. no CHOICE; no IMPLICIT tag.

I have no idea whether it's peculiar to Outlook Express
or also used in Outlook or any other details.

For gory details, here's a snippet from (a slightly
modified) Peter Gutmann's dumpasn1:

3829 30  201:g . . . . . . SEQUENCE {
3832 06    9:h . . . . . . . OBJECT IDENTIFIER '1 3 6 1 4 1 311 16 4'
3843 31  187:h . . . . . . . SET {
3846 30  184:i . . . . . . . . SEQUENCE {
3849 30  177:j . . . . . . . . . SEQUENCE {
3852 31   11:k . . . . . . . . . . SET {
3854 30    9:l . . . . . . . . . . . SEQUENCE {
3856 06    3:m . . . . . . . . . . . . OBJECT IDENTIFIER countryName (2 5 4 6)
3861 13    2:m . . . . . . . . . . . . PrintableString 'US'
            :l . . . . . . . . . . . }
            :k . . . . . . . . . . }
3865 31   18:k . . . . . . . . . . SET {
3867 30   16:l . . . . . . . . . . . SEQUENCE {
3869 06    3:m . . . . . . . . . . . . OBJECT IDENTIFIER
            :  . . . . . . . . . . . . . stateOrProvinceName (2 5 4 8)
3874 13    9:m . . . . . . . . . . . . PrintableString 'Wisconsin'
            :l . . . . . . . . . . . }
            :k . . . . . . . . . . }
3885 31   16:k . . . . . . . . . . SET {
3887 30   14:l . . . . . . . . . . . SEQUENCE {
3889 06    3:m . . . . . . . . . . . . OBJECT IDENTIFIER localityName (2 5 4 7)
3894 13    7:m . . . . . . . . . . . . PrintableString 'Madison'
            :l . . . . . . . . . . . }
            :k . . . . . . . . . . }
3903 31   32:k . . . . . . . . . . SET {
3905 30   30:l . . . . . . . . . . . SEQUENCE {
3907 06    3:m . . . . . . . . . . . . OBJECT IDENTIFIER
            :  . . . . . . . . . . . . . organizationName (2 5 4 10)
3912 13   23:m . . . . . . . . . . . . PrintableString 'University of Wisconsin'
            :l . . . . . . . . . . . }
            :k . . . . . . . . . . }
3937 31   43:k . . . . . . . . . . SET {
3939 30   41:l . . . . . . . . . . . SEQUENCE {
3941 06    3:m . . . . . . . . . . . . OBJECT IDENTIFIER
            :  . . . . . . . . . . . . . organizationalUnitName (2 5 4 11)
3946 13   34:m . . . . . . . . . . . . PrintableString 'Division of Information Technology'
            :l . . . . . . . . . . . }
            :k . . . . . . . . . . }
3982 31   45:k . . . . . . . . . . SET {
3984 30   43:l . . . . . . . . . . . SEQUENCE {
3986 06    3:m . . . . . . . . . . . . OBJECT IDENTIFIER commonName (2 5 4 3)
3991 13   36:m . . . . . . . . . . . . PrintableString 'UW Certificate Services -- 20000529A'
            :l . . . . . . . . . . . }
            :k . . . . . . . . . . }
            :j . . . . . . . . . }
4029 02    2:j . . . . . . . . . INTEGER 509
            :i . . . . . . . . }
            :h . . . . . . . }
            :g . . . . . . }

Eric Norman

        "I like to stand on the shoulders of the giants that
         have gone before me.  It is the only way I can see
         beyond the pile of dung that they left behind."

---

From: [email-masked] (Peter Gutmann)
Date: Tue, 9 Oct 2001 16:55:40 +1300 (NZDT)

Eric Norman <[email-masked]> writes:

>It's an OID that's used by Outlook Express to include the senders preferred
>encryption key among the bunch of certificates that are sent in a PKCS7
>signedData structure. The OID is 1.3.6.1.4.1.311.16.4 (seems to be in
>Microsoft's arc).  It is used as an authenticated attribute; the idea seems to
>be the same as SMIMEEncryptionKeyPreference (OID = 1.2.840.113549.1.9.16.2.11).
>The syntax is sligtly different; it "points to" the actual certificate with
>only IssuerAndSerialNumber; i.e. no CHOICE; no IMPLICIT tag.

It looks like you're using an old version of dumpasn1, this is already present
in the config:

-- Snip --

# This is just the normal issuerAndSerialNumber but with a MS-specific OID.
# Apparently it's used for CryptEncode/DecodeObject, whatever that is.
OID = 06 0A 2B 06 01 04 01 82 37 10 04
Comment = Microsoft attribute
Description = microsoftRecipientInfo (1 3 6 1 4 1 311 16 4)

-- Snip --

>http://www.imc.org/ietf-smime/other-smime-oids.asn

I think that's reserved specifically for S/MIME-related OIDs, not for any
random OID which a vendor might choose to invent.

Peter.