Subject: Re: [lamps] [Mathmesh] pkix-keyinfo content type

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Thu, 12 Sep 2019 16:41:42 +0000

Michael

I just read through your email.
I like your statement on the subjectKeyId in end entity certificates as it is quite handy to identify the public key to use in the protocol context.

> As SubjectKeyIdentifier can be calculated by any suitable way and used 
> if it is present, it's only for the case that it is not present that is a problem.
> Typically only CA:TRUE certificates are supposed to have it present.  
> I'd like it to be present for all certificates.

I was quite sad to see that the subjectKeyId is not recommended in DevID certificate profiles in IEEE 802.1AR.
Finally the subjectKeyId is not only be helpful to identify the issuing CA key/certificate but also the e.g. signing key/certificate for a JSON, XML, CMS object.
Also within CMP messages the subectKeyId can be used in the message header (senderKeyId) to clearly identify the key/certificate to use to validate the CMP protection. This makes the code to pick the right key/certificate much easier.
I typically recommend to use this extension also for end entiy certificates in my company.

Hendrik