On Thursday, November 06, 1997 11:49 AM, jsp(_at_)jgvandyke(_dot_)com
[SMTP:jsp(_at_)jgvandyke(_dot_)com] wrote:
2) Sec 2.2, I am not sure what you mean by "DH/DSS" as the "MUST support"
DigestEncryptionAlgorithmIdentifier. The PKIX X.509 Certificate and CRL
Profile (aka PKIX I), Section 7.2.2, recommends using the Digital Signature
Algorithm (DSA) OID (and asscoiated ASN.1 syntaxes) defined in the X9.57
specification as follows: id-dsa-with-sha1 ID ::= {iso(1) member-body(2)
us(840) x9-57 (10040) x9cm(4) 3 }. The problem with this OID is that
combines the SHA-1 and DSA into one value. The X9.57 id-dsa OID {1 2 840
10040 4 1} is intended for use in the X.509 Certificate subjectPublicKeyInfo
algorithmIdentifier field to identify a DSA public key, but I assume that it
could also be used as a DigestEncryptionAlgorithmIdentifier (with parameters
absent). I recommend using id-dsa with text explaining that the algorithm
parameters will always be absent.
Most errors like this are because of my current ignorance of DSA, DH,
etc. and their OIDs and parameters. Thanks for finding this.
So logically, what should appear in the
DigestEncryptionAlgorithmIdentifier? Is it the DSA OID? It should
*not* be the signature algorithm identifier (id-dsa-with-sha1). I
personally agree that it should be id-dsa as you pointed out, since
rsaEncryption is used in a certificate to identify an RSA public key.
Blake
--
Blake C. Ramsdell
Worldtalk Corporation
For current info, check http://www.deming.com/users/blaker
Voice +1 425 882 8861 x103 Fax +1 425 882 8060