Subject: rere: Question about SCEP!

From: "forward" <[email-masked]>
Date: Fri, 28 Jun 2002 12:42:24 +0800

Dear Pritikin
Last night , I find the reason. The reason is that CISCO2600 calculate
the MD5 'fingerprint' just on the raw PKCS#10 message before it
calculate the signature in PKCS#10. 
Thanks. 

-----邮件原件-----
发件人: Max Pritikin [mailto:[email-masked]] 
发送时间: 2002年6月28日 1:49
收件人: forward; [email-masked]
主题: RE: Question about SCEP!

(responding to the [email-masked]' mailing list)

MD5 is a one-way hash algorithm that takes any length of data and
produces a
128 bit "fingerprint" or "message digest". Pass the entire PKCS#10 into
your
MD5 function(s) to produce this 128 bit fingerprint and display it to
the
user.

The user can then tell the administrator this 128 bit fingerprint (out
of
band) such that the certificate request can be authenticated at the
server
by the administrator.

It doesn't sounds like this is your problem though. You indicate that
the
response is rejected by the Cisco 2600?

> In my SCEP server, I can decrypt and decode PKCSReq and can get the
> PKCS#10 then generate certificate for CISCO's router. The server
> generate the CertRep message and send it to CISCO2600. However the
> CISCO2600 tell me that it verify the massage failed.

This sounds like a configuration problem on your 2600. You may wish to
compare the behavior of the 2600 (using the same configuration) against
an
alternate SCEP server (one that is known to work with IOS).

	- Max

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of forward
> Sent: Thursday, June 27, 2002 5:32 AM
> To: [email-masked]
> Subject: Question about SCEP!
>
>
>
> Hi:
> I want to ask a question about SCEP. In SCEP there is a sentence " To
> prevent a "man-in-the-middle" attack, an MD5 'fingerprint' generated
on
> the PKCS#10(before PKCS#7 enveloping and signing ) must be compared
> out-of-band between the server and end entity". However I don't know
how
> the cisco's SCEP client calculate the MD5 'fingerprint'.
> In my SCEP server, I can decrypt and decode PKCSReq and can get the
> PKCS#10 then generate certificate for CISCO's router. The server
> generate the CertRep message and send it to CISCO2600. However the
> CISCO2600 tell me that it verify the massage failed.
> Can anybody tell me the reason?
> Thanks!
>
> Forward.li
>
>
>
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com