Question about Basic Authentication Scheme

[Stefan_Salzmann/HAM/[e-mail]]

Hello,

In draft-ietf-pkix-ipki3cmp-08.txt  Certification Management Protocol the basic
authentication scheme is described as:
 End entity                                          RA/CA
      ==========                                      =============
           out-of-band distribution of Initial Authentication
           Key (IAK) and reference value (RA/CA -> EE)
      Key generation
      Creation of certification request
      Protect request with IAK
                    -->>--certification request-->>--
                                                     verify request
                                                     process request
                                                     create response
                    --<<--certification response--<<--
      handle response
      create confirmation
                    -->>--confirmation message-->>--
                                                     verify confirmation

The Initial Authentication Key (IAK) distributed by the CA/RA is not used in
PKCS#10 described in RFC 2314. In that RFC the process of designing a
certification request will be carried out without the IAK. So why use it?? Isn´t
it better to use the private key for encrypting the certificate request message
rather than using the IAK?

Thanks for answering,
Stefan