Subject: Re: [pkix] some comments on draft-ietf-pkix-est-01

From: "Dan Harkins" <[email-masked]>
Date: Wed, 28 Mar 2012 02:04:04 -0700 (PDT)

Hi,

On Tue, 27 Mar 2012 at 11:25:05 Sean Turner said:
> Just a couple of comments the WG should consider:
>
>Technical:
>
> 1. the /simpleEnroll, /simpleReEnroll, and /serverKeyGen use PKCS#10s for
> the request and return the certificate(s) in a mime media type. In many
> instances, the "normal" query/response for a certificate is a PKCS#10
> request followed by a PKCS#7 response, where the PKCS#7 is the degenerate
> certs-only message. Does anyone see any benefit in reusing the
> PKCS#10/PKCS#7 model instead of PKCS#10/certificate? Changing it would
> align nicely/exactly with the simple PKI request/response from CMC.

  Yes, I see value in reusing the PKCS#10/PKCS#7 model. EST is supposed
to implement "simple CMC" and that should use a PKCS#7 as the simple
response.

  regards,

  Dan.