Subject: [dhcwg] draft-ietf-dhc-sedhcpv6

From: Francis Dupont <[email-masked]>
Date: Fri, 14 Nov 2014 04:38:12 +0100

BTW I find the section 5.1 Public Key Option and 5.2 (Public Key)
Certificate Option a bit loose:

 - for 5.1 I believe you want a SubjectPublicKeyInfo (cf RFC5280)
  which is the SEQUENCE of the AlgorithmIdentifier (which is in the
  5.1 text) and a BIT STRING holding the content of the key, i.e.,
  the SEQUENCE of the two INTEGERs n and e (cf PKCS#1), in DER.

 - for 5.2 IKEv2 (RFC 5996) in the Section 3.6 Certificate Payload
  defines some Certificate Encodings, I believe you want the X.509
  Certificate - Signature (4) Certificate Data (i.e., the DER
  encoded X.509 certificate).

Note you could get a similar issue if (when) you'll add new
signature algorithms, for instance DSA signature is usually
a DER-encoded SEQUENCE of a pair of INTEGERs but RFC 2536 uses
a different encoding for DNSSEC...

Thanks

[email-masked]