Subject: Naming keys in EncryptedData

From: Russ Housley <[email-masked]>
Date: Tue, 15 Nov 2005 19:54:38 -0500

X9.73 defines an additional CMS content type.  It is:

    NamedKeyEncryptedData ::= SEQUENCE {
       version Version,
       keyName KeyName OPTIONAL,
       encryptedContentInfo EncryptedContentInfo }

Does anyone see a reason to fold the keyName into EncryptedData?

The alternative is to assign an attribute that can be used to 
identify the key that is needed to decrypt the content.  That 
alternative would look like this:

    id-aa-contentDecryptKeyID OBJECT IDENTIFIER ::= { <TBD> }

    ContentDecryptKeyID::= OCTET STRING

I anticipate an update to RFC 3852 to address the ambiguity in 
handling of multiple SignerInfo, so it would not be difficult to add 
either the keyName to EncryptedData (with the appropriate version 
updates) or the ContentDecryptKeyID attribute.

Russ

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 16 Nov 2005 17:01:32 +1300

>Does anyone see a reason to fold the keyName into EncryptedData?

What is the KeyName, and what is one suppossed to do with it?

Peter.

---

From: Russ Housley <[email-masked]>
Date: Wed, 16 Nov 2005 11:40:17 -0500

Peter:

It is an OCTET STRING.  It identifies the content-encryption key that 
was previously distributed to the sender and one or more recipients.

Russ