Subject: pkinit: more DH clarity would be good

From: Chaskiel M Grundman <[email-masked]>
Date: Wed, 09 Feb 2005 17:15:19 -0500

The text says the following about DH:

   6.  The client's Diffie-Hellman public value (clientPublicValue) is
       included if and only if the client wishes to use the
       Diffie-Hellman key agreement method.  For the Diffie-Hellman key
       agreement method, implementations MUST support Oakley 1024-bit
       MODP well-known group 2 [RFC2412] [.. more about choosing groups]

I think that there should probably be more detail here. At the very least,
the text should specify that the SubjectPublicKeyInfo's
AlgorithmIdentifier's id is dhpublicnumber. I don't know how much detail is
really needed, but it seems that what's here is under-specified (or that
references to a more detailed treatment are missing. the earlier 2361
reference does not provide that detail).

Until I chased down the references in 3279 and 3280, I was under the
mistaken impression that the DomainParameters for the DH key were not
present in the AuthPack!