Re: [lamps] LAMPS sample keys and certificates

[Russ Housley <[e-mail]>]

DKG:

The perl script does yield the binary data, but the document does not use PEM format.

Russ


> On Nov 21, 2019, at 3:14 PM, Daniel Kahn Gillmor <[e-mail]> wrote:
> 
> Signed PGP part
> On Thu 2019-11-21 23:21:57 +0800, Sean Turner wrote:
>> Showing signs of age based on algorithm choices, but there is also:
>> 
>> https://datatracker.ietf.org/doc/rfc4134/
> 
> Thanks for this pointer!  I had looked for something like this, and even
> cornered Paul to ask him if he remembered writing such a thing, but came
> up empty.
> 
> I now see why i missed it in my earlier searches -- i was assuming that
> there would be a PEM-encoded form of the key and certificate objects,
> and had searched for PEM headers but did not find them.  It's
> interesting that there are no PEM-encoded objects here, just the output
> of dumpasn1 and a weird custom base64-encoded form in appendix B!
> 
> I agree with you that the algorithm choices are on the weaker side here
> (1024-bit RSA and DSS!), so i'm inclined to continue work on the new
> document, to have relatively modern certs to use for newer examples.
> 
> I'll definitely include a reference to this earlier work, though.
> 
>     --dkg
> 
> PS i've updated draft-dkg-lamps-sample-certs to use RSA (i'd originally
> tried to use RSA-PSS, but ran into trouble with using that in some
> tests), and to have the keyEncipherment flag set (rather than the
> dataEncipherment flag, which i had mistakenly set).
> 
>