Strange place for an algorithm identifier?

Hi -

I've recently been playing around with Trusted Platform Modules (TPMs).  
Most of them come with a manufacturer provided Endorsement Certificate 
(an X509 certificate of a particular form).

On one of these, I was able to retrieve the EK Cert and take a look at 
it - but ran into problems when Openssl and Java and others  stumbled 
over the AlgorithmIdentifier in the SubjectPublicKeyInfo part of the cert.

The certificate contains an RSA public key, but the public key is marked 
as 1.2.840.113549.1.1.7 - id-RSAES-OAEP rather than the more normal (in 
my experience) 1.2.840.113549.1.1.1 - rsaEncryption.  The body of the 
public key is as you would expect for a normal RSA public key.

I'm assuming they're trying to signal that the public key is only valid 
when verifying an OAEP signature.  I haven't found any documentation 
that describes this signalling though.

Has anyone else seen this?  If so, where (besides a TPM)?


Thanks- Mike


_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix