Subject: Change request for CMS

From: "Jim Schaad" <[email-masked]>
Date: Wed, 26 Jan 2005 12:23:16 -0800

Russ,

Sometimes I wonder if this will ever end - the endless updates to documents
as we find things that seem to be lacking.  Oh well.....

I find myself wanting to identify a key using the password recipient info
type in an enveloped data structure.  Specifcally I am sending a enveloped
data structure between a server and a client system.  They do not yet have
certificates setup so that there is no way to use a public/private key pair.
They however do have an identifier/passphase setup between them.  It would
be convient if one could place the identifier in the PasswordRecipientInfo
structure so that all of the data is together rather than looking in many
different places for the infomration needed.

I would like to change the structure to

PasswordRecipientInfo ::= SEQUENCE {
  version CMSVersion -- {v0, v1}
  kekid   [1] KEKIdentifier OPTIONAL, -- if present version = 1
  keyDerivationAlgorithm [0] KeyyDerivationAlgorithmIdentifier OPTIONAL,
  keyEncryptionAlgorithm  KeyEncryptionAlgorithmIdentifier,
  encryptedKey EncryptedKey
}

Jim

---

From: Russ Housley <[email-masked]>
Date: Thu, 27 Jan 2005 10:17:04 -0500

Jim:

I can see how this helps enrollment.

Aren't you trying to name the password?  Assuming the password is one to 
one and onto with the KEK, the identifier actually names both.

For a change of this size, I think that an update to the document (as 
opposed to the whole document) is appropriate.

Russ

---

From: "Jim Schaad" <[email-masked]>
Date: Thu, 27 Jan 2005 13:15:05 -0800

Russ,

Yes I am just trying to name the password, I suppose that all I need for
such an identifier is really a UTF8String.  I was just trying to re-use what
was already there.  

An update for this would be fine for me.

jim

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Russ Housley
> Sent: Thursday, January 27, 2005 7:17 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: Change request for CMS
> 
> 
> Jim:
> 
> Aren't you trying to name the password?  Assuming the 
> password is one to one and onto with the KEK, the identifier 
> actually names both.
> 
> For a change of this size, I think that an update to the 
> document (as opposed to the whole document) is appropriate.
> 
> Russ
> 
> >Sometimes I wonder if this will ever end - the endless updates to 
> >documents as we find things that seem to be lacking.  Oh well.....
> >
> >
> >I find myself wanting to identify a key using the password recipient 
> >info type in an enveloped data structure.  Specifcally I am 
> sending a 
> >enveloped data structure between a server and a client 
> system.  They do 
> >not yet have certificates setup so that there is no way to 
> use a public/private key pair.
> >They however do have an identifier/passphase setup between them.  It 
> >would be convient if one could place the identifier in the 
> >PasswordRecipientInfo structure so that all of the data is together 
> >rather than looking in many different places for the 
> infomration needed.
> >
> >
> >   keyDerivationAlgorithm [0] 
> KeyyDerivationAlgorithmIdentifier OPTIONAL,