Subject: [lamps] CSR attrs in rfc7030-clarify

From: Russ Housley <[email-masked]>
Date: Thu, 11 Jun 2020 10:59:57 -0400

Michael:

I have had an email exchange with someone that implemented EST, and they have pointed out that the aa-asymmDecryptKeyID attribute is not for inclusion in the CSR.  However, when the server does the public/private key pair generation, it is used to name the key to be used top protect the server-generated key.

This leads to two changes in rfc7030-clarify:

In Section 4.1:

OLD:

   AttrSet ATTRIBUTE ::= { aa-asymmDecryptKeyID, ... }

NEW:

   AttrSet ATTRIBUTE ::= { ... }

In Appendix A:

OLD:

  AttrSet ATTRIBUTE ::= { aa-asymmDecrytKeyID, ... }

NEW:

  AttrSet ATTRIBUTE ::= { ... }

Thanks,
  Russ

---

From: Michael Richardson <[email-masked]>
Date: Thu, 11 Jun 2020 15:44:53 -0400

Russ Housley <[email-masked]> wrote:
    > I have had an email exchange with someone that implemented EST, and
    > they have pointed out that the aa-asymmDecryptKeyID attribute is not
    > for inclusion in the CSR.  However, when the server does the
    > public/private key pair generation, it is used to name the key to be
    > used top protect the server-generated key.

Okay, fixed.

---

From: Russ Housley <[email-masked]>
Date: Thu, 11 Jun 2020 16:23:24 -0400

Thank you very much

> On Jun 11, 2020, at 3:44 PM, Michael Richardson <[email-masked]> wrote:
>