Subject: Re: [lamps] dtaft-ietf-lamps-cmp-updates and rsaKeyLen

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Wed, 16 Sep 2020 07:02:31 +0000

Russ

> Von: Russ Housley <[email-masked]>
> Gesendet: Dienstag, 15. September 2020 23:21
> 
> Hendrik:
> 
> The ASN.1 modules add rsaKeyLen, but the body of the document does not say
> anything.  I think it should explain the new field.

You are right. I will add a brief explanation to the respective section.

> 
> The ASN.1 module comment is the only hint right now:
> 
>       -- Any reasonable RSA key length, if subjectPublicKeyInfo
>       -- of the certTemplate has the OID rsaEncryption.
> 
> Also, if the certTemplate has the OID id-ecPublicKey, is a similar convention
> needed to provide a list of supported curves?

For rsaKeyLen it is possible to specify one key length and for id-ecPublicKey it is possible to specify one named curve in ECParameters. I think we are consistent in this regard.
If an RA needs to offer a set of allowed algorithms or curves, it can use the Signing Key Pair Types general message as specified in RFC 4210 Section 5.3.19.2.

Hendrik