RE: Password Based Encryption for RSA Keys

Joseph,

>Couldn't one use encrypt <ds:KeyValue/> as a <enc:EncryptedKey/> without 
>resorting to ASN.1?

 Yes, the only problem is that we have to choose a key derivation function
for the
 password based encryption, and this is out of scope for the spec. Choosing
something
 like PKCS#5 v2 or PKCS#12 for PBE would work, but nobody has specified
this.

>Well, this is one of those issues that if you specifiy/propose some text 
>for section 5, you might be able to win a consensus from the WG to adopt 
>it, but absent someone, who wants it, making a substantive proposal and 
>convincing others, it's not likely to happen! <smile/>

 Fair enough :) I just wanted to see if it was thought about. I can't say I
have
the expertise to make a proposal, although if I did, I would specify PBE as
specified in PKCS#5 version 2, but I'm not an expert and not aware of
advances
in PBE "technology."

Any takers?

Blake Dournaee
Toolkit Applications Engineer
RSA Security