Subject: draft-ietf-pkix-rfc2510bis-03

From: Ari Kermaier <[email-masked]>
Date: Thu, 15 Mar 2001 00:35:13 -0500

Dear All,

I'm seeking clarification of the challenge-response proof-of-possession 
protocol in CMP. The POP challenge is defined in section 3.2.8 as follows:

      Challenge ::= SEQUENCE {
          owf                 AlgorithmIdentifier  OPTIONAL,
          -- MUST be present in the first Challenge; MAY be omitted in any
          -- subsequent Challenge in POPODecKeyChallContent (if omitted,
          -- then the owf used in the immediately preceding Challenge is
          -- to be used).
          witness             OCTET STRING,
          -- the result of applying the one-way function (owf) to a
          -- randomly-generated INTEGER, A.  [Note that a different
          -- INTEGER MUST be used for each Challenge.]
          challenge           OCTET STRING
          -- the encryption (under the public key for which the cert.
          -- request is being made) of Rand, where Rand is specified as
          --   Rand ::= SEQUENCE {
          --      int      INTEGER,
          --       - the randomly-generated INTEGER A (above)
          --      sender   GeneralName
          --       - the sender's name (as included in PKIHeader)
          --   }
      }

1) What is the purpose of including the sender's name in the sequence to be 
encrypted? Does it guard against some sort of attack?

2) Since it is quite possible that the DER encoding of the Rand sequence 
will have length greater than k-11 octets, where k is the length of the RSA 
public modulus (for the RSA key case), what method should be used for 
performing this encryption and formatting the contents of the challenge 
OCTET STRING?

Any help would be most appreciated.

Ari Kermaier
Phaos Technology