Subject: PKINIT -29: OID names

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 17 Oct 2005 09:55:34 -0700

The symbolic names for the PKINIT OIDs did not follow any naming
convention, as the result, it was difficult for people to remember the
names and/or cite them in discussions.  Furthermore, because these names
will likely appear in real code of PKINIT implementations, we would
prefer to have self-explanatory names.

I would suggest having the following new names to replace the
corresponding old ones (hopefully this change is self-explanatory):

       id-pkinit-authData      OBJECT IDENTIFIER  ::= { id-pkinit 1 }
       id-pkinit-DHKeyData     OBJECT IDENTIFIER  ::= { id-pkinit 2 }
       id-pkinit-rkeyData      OBJECT IDENTIFIER  ::= { id-pkinit 3 }
       id-pkinit-KPClientAuth  OBJECT IDENTIFIER  ::= { id-pkinit 4 }
       id-pkinit-KPKdc         OBJECT IDENTIFIER  ::= { id-pkinit 5 }

       id-pkinit-san OBJECT IDENTIFIER ::=
         { iso(1) org(3) dod(6) internet(1) security(5) kerberosv5(2)
           x509SanAN (2) }

       id-pkinit-KPClientAuth OBJECT IDENTIFIER ::=
         { iso(1) org(3) dod(6) internet(1) security(5) kerberosv5(2)
           pkinit(3) keyPurposeClientAuth(4) }
              -- PKINIT client authentication.
              -- Key usage bits that MUST be consistent:
              -- digitalSignature.

       id-pkinit-KPKdc OBJECT IDENTIFIER ::=
         { iso(1) org(3) dod(6) internet(1) security(5) kerberosv5(2)
           pkinit(3) keyPurposeKdc(5) }
              -- Signing KDC responses.
              -- Key usage bits that MUST be consistent:
              -- digitalSignature.

-- Larry

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Tue, 18 Oct 2005 16:38:48 +0200

> corresponding old ones (hopefully this change is self-explanatory):

I think this change is great, but its hard to figure out that id-pkinit-KP
is for EKU and the other for contentType files in CMS.

Love

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 18 Oct 2005 10:47:27 -0700

the symbolic name has either "keyPurposeKdc" or "keyPurposeCliehtAuth", that is a strong hint that it means an EKU, right?
 
the other CMS OID names should also be self-explanatory.

________________________________

From: Love Hörnquist Åstrand [mailto:[email-masked]]
Sent: Tue 10/18/2005 7:38 AM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: PKINIT -29: OID names

Love

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Tue, 18 Oct 2005 22:23:16 +0200

Ah, ok, then I withdraw my objection.

Love

"Liqiang(Larry) Zhu" <[email-masked]> writes:

> the symbolic name has either "keyPurposeKdc" or "keyPurposeCliehtAuth", that is
> a strong hint that it means an EKU, right?
>  
> -------------------------------------------------------------------------------
> From: Love H?rnquist ?strand [mailto:[email-masked]]