Re: [lamps] dtaft-ietf-lamps-cmp-updates and rsaKeyLen

[Russ Housley <[e-mail]>]

Hendrik:

>> I had another though about rsaKeyLen.  RFC 4210 uses CertRequest as defined
>> on RFC 4211 in the certificate request, which is:
>> 
>>   CertRequest ::= SEQUENCE {
>>      certReqId     INTEGER,        -- ID for matching request and reply
>>      certTemplate  CertTemplate, --Selected fields of cert to be issued
>>      controls      Controls OPTIONAL } -- Attributes affecting issuance
>> 
>>   Controls  ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue
>> 
>> Would it be cleaner to define a new control for the rsaKeyLen?
>> 
>> These controls are already set up as an OID followed by one or more attribute
>> values.  So this seems like a very clean way to provide a minimum RSA key size
>> or a set of elliptic curves.
> 
> I am uncertain if this addressing the use case I had in mind. But may be I did not fully understand your suggestion.
> 
> I defined id-it-certReqTemplate to offer the EE means to request detailed guideline on the content of a certificate request it whishes to send. The response should include the option to specify the concrete algorithm to generate a key pair for. Therefor a prefilled certTemplate is exactly what we need, plus the key length for RSA keys in rsaKeyLen.
> The EE does not need to specify the key length of the RSA key in the certificate request itself when sending it to the PKI.
> 
> May be it helps, if you explain your use case.

I see.  Never mind.

Russ