Subject: CGA Issue #9: Referencing PKCS#1 (Russ Housley)

From: "Tuomas Aura" <[email-masked]>
Date: Mon, 22 Mar 2004 13:36:39 -0800

Russ Housley:

Discuss:
  The first paragraph of section 3 says:
  >
  >  ... For SEND, the public
  > key SHOULD be an RSA encryption key with the object identifier
  > rsaEncryption (i.e., "1.2.840.113549.1.1.1") and the subject public
  > key field SHOULD be formatted as an ASN.1 data structure of the type
  > RSAEncryptionKey defined in [PKCS.1.2002]. ...
  >
  PKCS #1 v2.1 (14 June 2002) does not specify a type of
RSAEncryptionKey.
  I suspect that a type of RSAPublicKey is intended.  This type and
  the associated object identifier can be found in RFC 3279 (as well as
  in PKCS #1 v2.1).  The community will be able to easily locate RFC
3279.
  Please refer to section 2.3.1 of RFC 3279.

  Further, the use of SHOULD bothers me.  The use of RSA can be SHOULD,
but
  the format of fields when RSA is selected ought to be a MUST.  I
suggest:
  
    SEND SHOULD use an RSA public/private key pair.  When RSA
    is used, the algorithm identifier must be rsaEncryption, which
    is 1.2.840.113549.1.1.1, and the RSA public key MUST be formatted
    using RSAPublicKey type as specified in section 2.3.1 of RFC 3279.

---
Tuomas Aura:
The above text sounds good to me.

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

This communication is confidential and intended solely for the addressee(s). Any unauthorized review, use, disclosure or distribution is prohibited. If you believe this message has been sent to you in error, please notify the sender by replying to this transmission and delete the message without disclosing it. Thank you.

E-mail including attachments is susceptible to data corruption, interruption, unauthorized amendment, tampering and viruses, and we only send and receive e-mails on the basis that we are not liable for any such corruption, interception, amendment, tampering or viruses or any consequences thereof.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 31 Mar 2004 21:35:56 +0300

> The above text sounds good to me.

Yes. Maybe s/must be/MUST be/

--Jari