RE: Certificate requests for encryption keys

[Jeff Brinskelle <jeff.brinskelle@xxxxxxxxxxx>]

I assume you are talking about PKIX-CMP and RFC 2510.
In which case according to the interop profile in 
> Appendix B8 of RFC 2510,  to initialize a user with 
> a verification and an encryption certificate, the 
> client should send an 'ir' with two CertReqMsg's, 
> the first one (certReqId = 0) must be the verification 
> request, the second one (certReqId = 1) can be the 
> encryption certificate request.
> 
> The message is protected using MSG_MAC_ALG, so 
> the senderKID is used to identify the client to the CA.
> 
> POP is necessary if the client generates the enc key 
> pair and does not include the encryption private key 
in the encryption request, in which case there are 
> options - indirect or direct POP (both described 
> in section 2.3 of RFC 2510).
> 
> 
> Hope this helps.
> 
> 
> 
> ----------
> From: 	Ilan Shacham[SMTP:ilans@arx.com]
> Sent: 	Tuesday, June 08, 1999 12:39 PM
> To: 	Ietf-Pkix (E-mail)
> Subject: 	Certificate requests for encryption keys
> 
> There has been much talk lately of using dual key pairs - one key pair
> for encryption, and one for signing.
> The following question arises - how does one create a certificate request
> for an encryption key pair? after all, the certificate request is signed
> by
> the key inside it, but the key is an encryption key, so this is illegal.
> 
> I can think of two possible solutions to this problem -
> 1. For the purposes of certification requests, and for this purpose only,
> the
> encryption key could be used to sign.
> 2. First, a certificate is issued to the signing key, and then the signing
> key
> is used to sign the certification request for the encoding key. (But this
> way
> there is no Proof Of Posession of the encryption key).
> 
> It looks to me like the first option is better, but I couldn't find any
> reference
> to this problem in the PKIX drafts/RFC's. Is there such a reference? are
> there any applications out there that confronted this problem?
> 
> Ilan
> 
> ------------------------------------------------------------------------
> Ilan Shacham				mailto:ilans@arx.com
> Algorithmic Research Ltd.		http://www.arx.com
> 10 Nevatim St.,			phone:	972 - 3 - 9279540
> Petach-Tikva, Israel			Fax:	972 - 3 - 9230864
>