Re: [lamps] dtaft-ietf-lamps-cmp-updates and rsaKeyLen

["Brockhaus, Hendrik" <[e-mail]>]

Russ

> -----Ursprüngliche Nachricht-----
> Von: Russ Housley <[e-mail]>
> 
> Hendrik:
> 
> I had another though about rsaKeyLen.  RFC 4210 uses CertRequest as defined
> on RFC 4211 in the certificate request, which is:
> 
>    CertRequest ::= SEQUENCE {
>       certReqId     INTEGER,        -- ID for matching request and reply
>       certTemplate  CertTemplate, --Selected fields of cert to be issued
>       controls      Controls OPTIONAL } -- Attributes affecting issuance
> 
>    Controls  ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue
> 
> Would it be cleaner to define a new control for the rsaKeyLen?
> 
> These controls are already set up as an OID followed by one or more attribute
> values.  So this seems like a very clean way to provide a minimum RSA key size
> or a set of elliptic curves.

I am uncertain if this addressing the use case I had in mind. But may be I did not fully understand your suggestion.

I defined id-it-certReqTemplate to offer the EE means to request detailed guideline on the content of a certificate request it whishes to send. The response should include the option to specify the concrete algorithm to generate a key pair for. Therefor a prefilled certTemplate is exactly what we need, plus the key length for RSA keys in rsaKeyLen.
The EE does not need to specify the key length of the RSA key in the certificate request itself when sending it to the PKI.

May be it helps, if you explain your use case.

Hendrik