Subject: Re: PKCS-12 Spec. History

From: [email-masked] (Peter Gutmann)
Date: Thu, 26 Apr 2001 05:50:15 (NZST)

Dale Gustafson <[email-masked]> writes:

>If we use anything other than v1.0, I suspect we'll have to dig up old copies
>of the spec. from the RSA archives (or somewhere).

It's not just the spec, you need to find old copies of the software to see what
they generate, which may not be what's in the spec (my favourite is the version
of Netscape which, when wrapping a pile of ASN.1 in a OCTET STRING, gave each
portion of the underlying data (ie each tag, each length, and each value
portion) its own individual constructed OCTET STRING fragment to live in).

If you're not being forced to use PKCS #12 for interop reasons, I'd go with a
PKCS #15 soft-token, which is a much nicer format.

Peter.

---

From: Dale Gustafson <[email-masked]>
Date: Wed, 25 Apr 2001 12:58:02 -0500

> PKCS #15 soft-token, which is a much nicer format.

Interop is the main attraction to PKCS-12.  Something that existing secure
applications can import and export.

If they support, or could easily (be extended to) support, a PKCS-15 soft-token
then that'd be a good way to go.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 26 Apr 2001 15:33:53 +0100

Peter,

Have you compiled any info on p#15 soft-token implementations?
(Assuming there's a few out there.)

If so, do you reckon there's a useful "profile" we could 
document/reference as the basic sacred credential format?

Ta,
Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:[email-masked]
Ireland                             http://www.baltimore.com