[lamps] key algorithm in CSR

Michael Richardson <mcr+ietf@sandelman.ca> Thu, 27 May 2021 14:16 UTC

From: Michael Richardson <mcr+ietf@sandelman.ca>
To: spasm@ietf.org, max pritikin <pritikin@cisco.com>
cc: anima@ietf.org
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Date: Thu, 27 May 2021 10:16:10 -0400
Message-ID: <29593.1622124970@dooku>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/1MObPRQM7eARY7JsgMtq477D3AI>
Subject: [lamps] key algorithm in CSR
Precedence: list

RFC7030 defines the CSR attributes.
It says:
   "In addition, a CA may desire to certify a certain type of public key and
   a client may not have a priori knowledge of that fact.  "

and:
  If the CA requires a particular crypto system or use of a particular
  signature scheme (e.g., certification of a public key based on a
  certain elliptic curve, or signing using a certain hash algorithm) it
  MUST provide that information in the CSR Attribute Response.

I think that this means, if a CA wants RSA, then it should include the
attribute sha256WithRSAEncryption ( 1 2 840 113549 1 1 11 ).
It feels odd, because that's not an DN attribute.

I am asking this because my ACP implementation has to deal with RSA
certificates until everything is ECDSA happy.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [

Attachment: signature.asc

[lamps] key algorithm in CSR Michael Richardson
Re: [lamps] key algorithm in CSR Panos Kampanakis (pkampana)

[lamps] key algorithm in CSR

Attachment: signature.asc