Re: PKCS-12 Spec. History

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Dale Gustafson <dale.gustafson@xxxxxxxx> writes:

>If we use anything other than v1.0, I suspect we'll have to dig up old copies
>of the spec. from the RSA archives (or somewhere).

It's not just the spec, you need to find old copies of the software to see what
they generate, which may not be what's in the spec (my favourite is the version
of Netscape which, when wrapping a pile of ASN.1 in a OCTET STRING, gave each
portion of the underlying data (ie each tag, each length, and each value
portion) its own individual constructed OCTET STRING fragment to live in).

If you're not being forced to use PKCS #12 for interop reasons, I'd go with a
PKCS #15 soft-token, which is a much nicer format.

Peter.