x509 request attributes

[Paul Forgey]

I'm trying to pass an pkcs9_challengePassword in an X509 request 
object, which appears to be considered an "attribute".

So I'm adding it with:
X509_REQ_add1_attr_by_NID (req, NID_pkcs9_challengePassword, 
V_ASN1_T61STRING, "test passphrase", 15);

The request gets DER encoded and decoded on the receiving end with 
everything else intact.  It survives the self-signature check so we 
have an intact request.  It appears I need to do something like this:

idx = X509_REQ_get_attr_by_NID (req, NID_pkcs9_challengePassword, -1);
if (idx >= 0)
{
  X509_ATTRIBUTE *attr = X509_REQ_get_attr (req, idx);
  ..
The attribute is found, but I can't find any way to make sense of it.  
It appears to contain garbage, but there are multiple ways I could 
sensibly interpret this structure of unions of structures.

What I am I supposed to be doing?
Thanks..
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
User Support Mailing List                    [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]