2.27. 更新 Appendix C - Request Message 行为澄清

2.27. 更新 Appendix C - Request Message 行为澄清

[RFC4210] Appendix C 提供 request message behavior 的澄清. 由于本文档按上文 Section 2.7 所述, 将 [RFC4210] 更新为使用 parent structure EncryptedKey 而不是 EncryptedValue, 因此相应更新该描述.

将 POPOSigningKey 定义之后 ASN.1 语法中的注释替换为以下文本 (Note: 这修复 Errata ID 2615):

-- **********
-- * For the purposes of this specification, the ASN.1 comment
-- * given in [RFC4211] pertains not only to certTemplate but
-- * also to the altCertTemplate control.
-- **********
-- * The signature (using "algorithmIdentifier") is on the
-- * DER-encoded value of poposkInput (i.e., the "value" OCTETs
-- * of the POPOSigningKeyInput DER).  NOTE: If CertReqMsg
-- * certReq certTemplate (or the altCertTemplate control)
-- * contains the subject and publicKey values, then poposkInput
-- * MUST be omitted and the signature MUST be computed on the
-- * DER-encoded value of CertReqMsg certReq (or the DER-
-- * encoded value of AltCertTemplate).  If
-- * certTemplate/altCertTemplate does not contain both the
-- * subject and public key values (i.e., if it contains only
-- * one of these or neither), then poposkInput MUST be present
-- * and MUST be signed.
-- **********

将 POPOPrivKey 的 ASN.1 语法替换为以下文本:

POPOPrivKey ::= CHOICE {
    thisMessage       [0] BIT STRING,   -- deprecated
    subsequentMessage [1] SubsequentMessage,
    dhMAC             [2] BIT STRING,   -- deprecated
    agreeMAC          [3] PKMACValue,
    encryptedKey      [4] EnvelopedData }

-- **********
-- * When using CMP V2, the encrypted value MUST be transferred in
-- * the thisMessage field that is given as BIT STRING in [RFC4211],
-- * but it requires EncryptedValue. Therefore, this document makes
-- * the behavioral clarification for CMP V2 of specifying that the
-- * contents of "thisMessage" MUST be encoded as an
-- * EncryptedValue and then wrapped in a BIT STRING.
-- * When using CMP V3, the encrypted value MUST be transferred
-- * in the encryptedKey field, as specified in Section 5.2.2.
-- **********