Subject: [pkix] RFC 5280 - 4.1.2.3. Signature

From: "Erik Andersen" <[email-masked]>
Date: Fri, 15 Jul 2011 18:03:49 +0200

I will jump to a RFC 5280 question now.

What should be put into the Signature field as defined in RFC 5280 - 4.1.2.3
for a to-be-signed certificate?

Erik Andersen

Andersen's L-Service

Elsevej 48,

DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

e-amail: [email-masked]

Skype: andersen-erik

http://www.x500.eu/

http://www.x500standard.com/

 <http://dk.linkedin.com/in/andersenerik>
http://dk.linkedin.com/in/andersenerik

---

From: Bruce Stephens <[email-masked]>
Date: Fri, 15 Jul 2011 17:09:10 +0100

"Erik Andersen" <[email-masked]> writes:

> What should be put into the Signature field as defined in RFC 5280 -
> 4.1.2.3 for a to-be-signed certificate?

It's as written, isn't it?

   This field MUST contain the same algorithm identifier as the
   signatureAlgorithm field in the sequence Certificate (Section
   4.1.1.2).  The contents of the optional parameters field will vary

[...]

---

From: "Erik Andersen" <[email-masked]>
Date: Fri, 15 Jul 2011 18:22:17 +0200

Hi Bruce,

Sure - my point was, if it is a to-be-signed certificate, the field you
refer to is not present or am I misunderstanding something. 

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

-----Oprindelig meddelelse-----
Fra: [email-masked] [mailto:[email-masked]] På vegne af Bruce
Stephens
Sendt: 15. juli 2011 18:09
Til: PKIX
Emne: [Spam] Re: [pkix] RFC 5280 - 4.1.2.3. Signature

[...]

_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: Bruce Stephens <[email-masked]>
Date: Fri, 15 Jul 2011 17:27:44 +0100

> refer to is not present or am I misunderstanding something. 

As far as I know the toBeSigned structure doesn't exist (or isn't being
discussed in RFC 5280, anyway) except as it exists in a Certificate.  So
it makes sense for toBeSigned fields to give information about the
signature.

[...]

---

From: "Erik Andersen" <[email-masked]>
Date: Fri, 15 Jul 2011 18:41:00 +0200

As I understand, a to-be-signed certificate may be used as trust anchor
information.

Can I conclude that the field shall hold the value you would use for
signing, if you were to sign it, but never going to?

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

-----Oprindelig meddelelse-----
Fra: [email-masked] [mailto:[email-masked]] På vegne af Bruce
Stephens
Sendt: 15. juli 2011 18:28
Til: [email-masked]
Emne: [Spam] Re: [pkix] [Spam] Re: RFC 5280 - 4.1.2.3. Signature

[...]

---

From: Carl Wallace <[email-masked]>
Date: Fri, 15 Jul 2011 12:53:50 -0400

>signing, if you were to sign it, but never going to?

See RFC 5914, Section 3, paragraph 1.

---

From: Bruce Stephens <[email-masked]>
Date: Fri, 15 Jul 2011 19:32:11 +0100

>>As I understand, a to-be-signed certificate may be used as trust anchor

You're right, I had forgotten about its use in RFC 5914.

> See RFC 5914, Section 3, paragraph 1.

So (as I'd expect) it has no meaning in this context, though we'd
anticipate that it would have the same value as in some certificate
(just because you'd probably be creating it by removing the signature
from a certificate and adjusting the content a little).