[lamps] Re: WG Last Call for draft-ietf-lamps-csr-attestation-09

["Brockhaus, Hendrik" <[e-mail]>]

I did not see any response to the point on PKCS#10/CRMF vs. CMP/CMC/EST/SCEP

> Von: Henk Birkholz <[e-mail]>
>
> > On 23.05.24 13:53, Carl Wallace wrote:
> > - The second paragraph implies that the mechanisms are only applicable to
> > RFC2986 or RFC4211 contexts. Is there some reason these could not be used
> > in SCEP, CMPv2 (or later), CMC, EST, future protocols, etc. Maybe replace 
> > "in
> > either" with "such as" to avoid this limitation. There are many places in 
> > the
> > draft that appear to limit use to PKCS #10 and CRMF, however.
>
> not an expert, but mentioning re-usability gets a +1 from me, if other
> contributors do not have objections.
>

Certificate signing requests formats like RFC 2986 (PKCS#10) and RFC 4211 
(Certificate Request Message Format, CRMF) provide binding the public key with 
the requested certificate content and a proof-of-private-key-possession.
CMP/CMC/EST/SCEP provide the binding of a certificate request (PKCS#10/CRMF) 
to a proof-of-identity.
By using either PKCS#10 or CRMF, the above-mentioned certificate 
management/enrollmnet protocols can utilize the attribute/extension defined 
here.
@Carl, does this answer your question?

Hendrik