Re: Strange place for an algorithm identifier?

Mike,

See RFC 3560, where that value is defined and its usage described:

   When the RSA private key owner wishes to limit the use of the public
   key exclusively to RSAES-OAEP, then the id-RSAES-OAEP object
   identifier MUST be used in the algorithm field within the subject
   public key information , and the parameters field MUST contain
   RSAES-OAEP-params.

For TPM 1.2, section 3.2.7 of "TCG Credential Profiles for TPM Family 1.2" at

https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profiles_V1.2_Level2_Revision8.pdf

requires the use of id-RSAES-OAEP for the algorithm identifier in the subject public key info field of the EK certificate.

For TPM 2.0, TCG has changed back to rsaEncryption for that field because "the uncommon OID used in TPM 1.2 could not be processed by most of the standard libraries", as you can see in "TCG EK Credential Profile for TPM 2.0" at

https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf

As you can see, you're not the first to be bitten by this problem.

Thanks,

Steve

-----Original Message-----
From: pkix [mailto:[email protected]] On Behalf Of Michael StJohns
Sent: Friday, August 12, 2016 3:07 PM
To: [email protected]
Subject: [pkix] Strange place for an algorithm identifier?

Hi -

I've recently been playing around with Trusted Platform Modules (TPMs).  
Most of them come with a manufacturer provided Endorsement Certificate 
(an X509 certificate of a particular form).

On one of these, I was able to retrieve the EK Cert and take a look at 
it - but ran into problems when Openssl and Java and others  stumbled 
over the AlgorithmIdentifier in the SubjectPublicKeyInfo part of the cert.

The certificate contains an RSA public key, but the public key is marked 
as 1.2.840.113549.1.1.7 - id-RSAES-OAEP rather than the more normal (in 
my experience) 1.2.840.113549.1.1.1 - rsaEncryption.  The body of the 
public key is as you would expect for a normal RSA public key.

I'm assuming they're trying to signal that the public key is only valid 
when verifying an OAEP signature.  I haven't found any documentation 
that describes this signalling though.

Has anyone else seen this?  If so, where (besides a TPM)?


Thanks- Mike


_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix