Re: [COSE] 802.1AR example

[Esko Dijk <[e-mail]>]

Hi Göran,

In case it’s useful: there’s more X.509 examples including one IDevID in our draft: https://datatracker.ietf.org/doc/html/draft-ietf-anima-constrained-voucher#appendix-C.2
(For the IDevID, the “NotAfter” field wasn’t set to the max value because I couldn’t easily get OpenSSL to do this. In C509 this should become the ‘null’ value actually.)

It’s not a real device example, but a best-effort approximation of the 802.1AR standard.

Esko

From: COSE <[e-mail]> On Behalf Of Göran Selander
Sent: Tuesday, November 7, 2023 14:34
To: Robert Moskowitz <[e-mail]>; [e-mail]
Subject: Re: [COSE] 802.1AR example

Thanks, Bob!

I wasn’t clear in the meeting what we have and what we may be missing.

In section A.2 of C509 (https://datatracker.ietf.org/doc/html/draft-ietf-cose-cbor-encoded-cert-07#name-example-ieee-8021ar-profile) we are referring to section A.2 / C.2 in RFC 9148, which has similar certificates to the once you just sent. Very similar indeed, they are also made with your script 😊.

The open issue was whether we should go with these or try to find deployed IDevID certificates from some device.

Let’s continue the discussion offlist!

Göran





From: COSE <[e-mail]<mailto:[e-mail]>> on behalf of Robert Moskowitz <[e-mail]<mailto:[e-mail]>>
Date: Tuesday, 7 November 2023 at 13:55
To: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Subject: Re: [COSE] 802.1AR example


On 11/7/23 07:41, Robert Moskowitz wrote:
> I just checke my draft:
>
> draft-moskowitz-ec-pki/draft-moskowitz-ec-pki
>
> And there are no actual examples.  So I looked in my files where I did
> the testing for writing this and here is a 1AR DER:
>
> -----BEGIN CERTIFICATE-----
> MIICYzCCAgmgAwIBAgIIUQ3O0GPrmkYwCgYIKoZIzj0EAwIwWDELMAkGA1UEBhMC
> VVMxCzAJBgNVBAgMAk1JMREwDwYDVQQHDAhPYWsgUGFyazEXMBUGA1UECgwOSFRU
> IENvbnN1bHRpbmcxEDAOBgNVBAMMB1Jvb3QgQ0EwIBcNMTcwODE4MTg0MTExWhgP
> OTk5OTEyMzEyMzU5NTlaMDwxFzAVBgNVBAoMDkhUVCBDb25zdWx0aW5nMRAwDgYD
> VQQLDAdEZXZpY2VzMQ8wDQYDVQQFEwZXdDEyMzQwWTATBgcqhkjOPQIBBggqhkjO
> PQMBBwNCAASDND5LR1ti1BF1Cie7sbvYtPxKA55xDVr6SbUPtfkQlux/3G7ld1f7
> E6QstR43jNftY2r3Fewa9h+5NVcAkhSZo4HWMIHTMAkGA1UdEwQCMAAwgYkGA1Ud
> IwSBgTB/gBQm/YWlGql/tNedOcaEzHx40Ur/gqFcpFowWDELMAkGA1UEBhMCVVMx
> CzAJBgNVBAgMAk1JMREwDwYDVQQHDAhPYWsgUGFyazEXMBUGA1UECgwOSFRUIENv
> bnN1bHRpbmcxEDAOBgNVBAMMB1Jvb3QgQ0GCCQDyYdUCUKbOqjAOBgNVHQ8BAf8E
> BAMCBaAwKgYDVR0RBCMwIaAfBggrBgEFBQcIBKATMBEGCSsGAQQBtDsKAQQEAQID
> BDAKBggqhkjOPQQDAgNIADBFAiEAz/lrMNjZO+aaGi+sdsmHwSQWJjaEiBnCyJq5
> 7jiZb3ACIGvMYqqrtgnDPOM/tDQ9UAm2zEzNmrLmGC+6xJDLxqTG
> -----END CERTIFICATE-----
>
>
> See what you get when you cbor it!

openssl x509 -noout -text -in
/home/rgm/data/ca/8021ARintermediate/certs/Wt1234.cert.pem
Certificate:
     Data:
         Version: 3 (0x2)
         Serial Number: 5840551686194305606 (0x510dced063eb9a46)
         Signature Algorithm: ecdsa-with-SHA256
         Issuer: C = US, ST = MI, L = Oak Park, O = HTT Consulting, CN =
Root CA
         Validity
             Not Before: Aug 18 18:41:11 2017 GMT
             Not After : Dec 31 23:59:59 9999 GMT
         Subject: O = HTT Consulting, OU = Devices, serialNumber = Wt1234
         Subject Public Key Info:
             Public Key Algorithm: id-ecPublicKey
                 Public-Key: (256 bit)
                 pub:
                     04:83:34:3e:4b:47:5b:62:d4:11:75:0a:27:bb:b1:
                     bb:d8:b4:fc:4a:03:9e:71:0d:5a:fa:49:b5:0f:b5:
                     f9:10:96:ec:7f:dc:6e:e5:77:57:fb:13:a4:2c:b5:
                     1e:37:8c:d7:ed:63:6a:f7:15:ec:1a:f6:1f:b9:35:
                     57:00:92:14:99
                 ASN1 OID: prime256v1
                 NIST CURVE: P-256
         X509v3 extensions:
             X509v3 Basic Constraints:
                 CA:FALSE
             X509v3 Authority Key Identifier:
keyid:26:FD:85:A5:1A:A9:7F:B4:D7:9D:39:C6:84:CC:7C:78:D1:4A:FF:82
                 DirName:/C=US/ST=MI/L=Oak Park/O=HTT Consulting/CN=Root CA
                 serial:F2:61:D5:02:50:A6:CE:AA
             X509v3 Key Usage: critical
                 Digital Signature, Key Encipherment
             X509v3 Subject Alternative Name:
                 othername: 1.3.6.1.5.5.7.8.4::<unsupported>
     Signature Algorithm: ecdsa-with-SHA256
     Signature Value:
         30:45:02:21:00:cf:f9:6b:30:d8:d9:3b:e6:9a:1a:2f:ac:76:
         c9:87:c1:24:16:26:36:84:88:19:c2:c8:9a:b9:ee:38:99:6f:
         70:02:20:6b:cc:62:aa:ab:b6:09:c3:3c:e3:3f:b4:34:3d:50:
         09:b6:cc:4c:cd:9a:b2:e6:18:2f:ba:c4:90:cb:c6:a4:c6

openssl asn1parse -i -in
/home/rgm/data/ca/8021ARintermediate/certs/Wt1234.cert.pem
     0:d=0  hl=4 l= 611 cons: SEQUENCE
     4:d=1  hl=4 l= 521 cons:  SEQUENCE
     8:d=2  hl=2 l=   3 cons:   cont [ 0 ]
    10:d=3  hl=2 l=   1 prim:    INTEGER           :02
    13:d=2  hl=2 l=   8 prim:   INTEGER           :510DCED063EB9A46
    23:d=2  hl=2 l=  10 cons:   SEQUENCE
    25:d=3  hl=2 l=   8 prim:    OBJECT            :ecdsa-with-SHA256
    35:d=2  hl=2 l=  88 cons:   SEQUENCE
    37:d=3  hl=2 l=  11 cons:    SET
    39:d=4  hl=2 l=   9 cons:     SEQUENCE
    41:d=5  hl=2 l=   3 prim:      OBJECT            :countryName
    46:d=5  hl=2 l=   2 prim:      PRINTABLESTRING   :US
    50:d=3  hl=2 l=  11 cons:    SET
    52:d=4  hl=2 l=   9 cons:     SEQUENCE
    54:d=5  hl=2 l=   3 prim:      OBJECT :stateOrProvinceName
    59:d=5  hl=2 l=   2 prim:      UTF8STRING        :MI
    63:d=3  hl=2 l=  17 cons:    SET
    65:d=4  hl=2 l=  15 cons:     SEQUENCE
    67:d=5  hl=2 l=   3 prim:      OBJECT            :localityName
    72:d=5  hl=2 l=   8 prim:      UTF8STRING        :Oak Park
    82:d=3  hl=2 l=  23 cons:    SET
    84:d=4  hl=2 l=  21 cons:     SEQUENCE
    86:d=5  hl=2 l=   3 prim:      OBJECT :organizationName
    91:d=5  hl=2 l=  14 prim:      UTF8STRING        :HTT Consulting
   107:d=3  hl=2 l=  16 cons:    SET
   109:d=4  hl=2 l=  14 cons:     SEQUENCE
   111:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
   116:d=5  hl=2 l=   7 prim:      UTF8STRING        :Root CA
   125:d=2  hl=2 l=  32 cons:   SEQUENCE
   127:d=3  hl=2 l=  13 prim:    UTCTIME           :170818184111Z
   142:d=3  hl=2 l=  15 prim:    GENERALIZEDTIME   :99991231235959Z
   159:d=2  hl=2 l=  60 cons:   SEQUENCE
   161:d=3  hl=2 l=  23 cons:    SET
   163:d=4  hl=2 l=  21 cons:     SEQUENCE
   165:d=5  hl=2 l=   3 prim:      OBJECT :organizationName
   170:d=5  hl=2 l=  14 prim:      UTF8STRING        :HTT Consulting
   186:d=3  hl=2 l=  16 cons:    SET
   188:d=4  hl=2 l=  14 cons:     SEQUENCE
   190:d=5  hl=2 l=   3 prim:      OBJECT :organizationalUnitName
   195:d=5  hl=2 l=   7 prim:      UTF8STRING        :Devices
   204:d=3  hl=2 l=  15 cons:    SET
   206:d=4  hl=2 l=  13 cons:     SEQUENCE
   208:d=5  hl=2 l=   3 prim:      OBJECT            :serialNumber
   213:d=5  hl=2 l=   6 prim:      PRINTABLESTRING   :Wt1234
   221:d=2  hl=2 l=  89 cons:   SEQUENCE
   223:d=3  hl=2 l=  19 cons:    SEQUENCE
   225:d=4  hl=2 l=   7 prim:     OBJECT            :id-ecPublicKey
   234:d=4  hl=2 l=   8 prim:     OBJECT            :prime256v1
   244:d=3  hl=2 l=  66 prim:    BIT STRING
   312:d=2  hl=3 l= 214 cons:   cont [ 3 ]
   315:d=3  hl=3 l= 211 cons:    SEQUENCE
   318:d=4  hl=2 l=   9 cons:     SEQUENCE
   320:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Basic
Constraints
   325:d=5  hl=2 l=   2 prim:      OCTET STRING      [HEX DUMP]:3000
   329:d=4  hl=3 l= 137 cons:     SEQUENCE
   332:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Authority
Key Identifier
   337:d=5  hl=3 l= 129 prim:      OCTET STRING      [HEX
DUMP]:307F801426FD85A51AA97FB4D79D39C684CC7C78D14AFF82A15CA45A3058310B3009060355040613025553310B300906035504080C024D493111300F06035504070C084F616B205061726B31173015060355040A0C0E48545420436F6E73756C74696E673110300E06035504030C07526F6F74204341820900F261D50250A6CEAA
   469:d=4  hl=2 l=  14 cons:     SEQUENCE
   471:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Key Usage
   476:d=5  hl=2 l=   1 prim:      BOOLEAN           :255
   479:d=5  hl=2 l=   4 prim:      OCTET STRING      [HEX DUMP]:030205A0
   485:d=4  hl=2 l=  42 cons:     SEQUENCE
   487:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Subject
Alternative Name
   492:d=5  hl=2 l=  35 prim:      OCTET STRING      [HEX
DUMP]:3021A01F06082B06010505070804A013301106092B06010401B43B0A01040401020304
   529:d=1  hl=2 l=  10 cons:  SEQUENCE
   531:d=2  hl=2 l=   8 prim:   OBJECT            :ecdsa-with-SHA256
   541:d=1  hl=2 l=  72 prim:  BIT STRING

openssl asn1parse -i -strparse 492 -in
/home/rgm/data/ca/8021ARintermediate/certs/Wt1234.cert.pem
     0:d=0  hl=2 l=  33 cons: SEQUENCE
     2:d=1  hl=2 l=  31 cons:  cont [ 0 ]
     4:d=2  hl=2 l=   8 prim:   OBJECT            :1.3.6.1.5.5.7.8.4
    14:d=2  hl=2 l=  19 cons:   cont [ 0 ]
    16:d=3  hl=2 l=  17 cons:    SEQUENCE
    18:d=4  hl=2 l=   9 prim:     OBJECT :1.3.6.1.4.1.6715.10.1
    29:d=4  hl=2 l=   4 prim:     OCTET STRING      [HEX DUMP]:01020304

Bob

_______________________________________________
COSE mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/cose