I have a question about the tag values used by decode_PA_PK_AS_REQ_Win2k() (also the encode routine). win2k (draft9) pkinit draft uses the following tags: signedAuthPack [0] trustedCertifiers [1] kdcCert [2] encryptionCert [3] However, the code uses values: signedAuthPack [0] trustedCertifiers[2] kdcCert[3] encryptionCert[4] It seems that tag values were shifted by 1.