Subject: Small Request on PKINIT...

From: Carlisle Adams <[email-masked]>
Date: Fri, 14 Nov 1997 17:49:58 -0500

Hi all,

I've (finally) had a moment to glance through
draft-ietf-cat-kerberos-pk-init-04.txt again and noticed the  definition
for userCert (in PA-PK-AS-REQ, for example):

    PA-PK-AS-REQ ::= SEQUENCE {
                                -- PA TYPE 14
        signedAuthPack          [0] SignedAuthPack
        userCert                [1] SEQUENCE OF Certificate OPTIONAL,
                                    -- the user's certificate chain
        trustedCertifiers       [2] SEQUENCE OF PrincipalName OPTIONAL
                                    -- CAs that the client trusts
    }

Is there any chance that the definition of userCert could be generalized
somewhat?  I was thinking of something along the lines of what has been
proposed for PKCS #7 v2:

   X509Info ::= SEQUENCE OF X509Item

   X509Item ::= CHOICE { -- all X.509
     [0] Certificate,
     [1] CRL,
     [2] AttributeCertificate }

Now you may or may not want to duplicate this structure exactly, but the
idea of a CHOICE between at least a cert. and an attribute cert. seems
like a generally useful concept.  Furthermore, having the CHOICE allows
you to add new choices later, if desired (such as other types of
certificates, or CRLs, or whatever).

Thoughts?

--------------------------------------------
Carlisle Adams
Entrust Technologies
[email-masked]
--------------------------------------------