Re: Certificate requests for encryption keys

["David P. Kemp" <dpkemp@xxxxxxxxxxxxxx>]

> From: "Bob Jueneman" <BJUENEMAN@novell.com>
>
>  [...]
> 
> Our working, temporary expedient, along the lines of your #1,
> is to type the private key for both encryption and signature, but to 
> only turn on the encryption bit in the certificate.  But that's an 
> admittedly ugly hack.  Worse yet, it won't work at all with a 
> DH encryption key.
> 
> The real question is what are existing CAs prepared to support
> with respect to more advanced POP protocols?



You mean "more advanced protocols" such as the one defined in
PKIX RFC 2510/2511?  I believe there is at least one CA which
supports POP for key transport (RSA) and key agreement (DH or KEA)
keys in the standard manner.