Re: [ipwave] permission

Dear Alex, Dear All,

I am not sure to follow here. ETSI provides on its website the ASN1 code (a zip file) for the ETSI security framework version 1.3 (and you can parse it into C or C++ code). We are using it on a network simulator VANETZA. Neither the side nor the content of the .zip file indicate we cannot use it. I am not making any commercial product though...

Of course, there is a difference between accessing the document or the ASN1 code. The ETSI Security standard v1.3 provides a full description of the 'main' message blocks and functional requirements for all DAY 1 ETSI services. Indeed, the ETSI document points to some 1609.2 structures in 1609.2 documents, which I could not access, but I could get the structures details from the ASN1 code. From my understanding and my experience in implementing the 1.3.1 code, I do not need 1609.2 document to make it work, all functional requirements are in the ETSI document.

One point:  I only implemented the security framework stack, not the algorithms to build public/private keys or certificate chains. Maybe for that, there is an issue...not sure,

BR,

Jérôme

-----Original Message-----
From: its <its-bounces@ietf.org> On Behalf Of Alexandre Petrescu
Sent: Monday, 26 April 2021 19:18
To: William Whyte <wwhyte@qti.qualcomm.com>; Mounira MSAHLI <msahli1717@gmail.com>
Cc: its@ietf.org
Subject: Re: [ipwave] permission

Le 26/04/2021 à 16:29, William Whyte a écrit :
>>> - the specs of CA must be implementable independently of other 
>>> paying
> sources such as (some) from IEEE or ISO.  For example, the ETSI ITS 
> spec that IMPORTS 1609.2 does not qualify because in the end it is 
> paying.  But the X.509 in RFC 5280 does not rely on other paying 
> documents in order to implement (I think?).
> 
>>> William could answer you this question better than me because it was
> already asked by ETSI.
> 
> Yes, 1609.2 needs to be purchased from IEEE. ETSI has reproduced the
>  ASN.1 (with permission from IEEE)

Is that permission from IEEE only for ETSI or is it for me too?

Because the text says: "This clause provides the relevant ASN.1 modules from IEEE Std 1609.2 [1] (and its amendments), reprinted with permission from IEEE, Copyright © 2016."

To me, that means a permission to print, but not necessarily to put in code.

Alex

  but there are some subtleties of
> implementation and how the crypto operations are carried out that 
> aren’t captured in the ASN.1 alone.
> 
> I’d note that Alex’s preference for standards to be freely available 
> if they are to be referenced by IETF is a reasonable point of view, 
> but it’s not IETF policy; IETF policy allows non-free standards to be  
> referenced.
> 
> Cheers,
> 
> William
> 
> *From:* its <its-bounces@ietf.org> *On Behalf Of * Mounira MSAHLI
> *Sent:* Monday, April 26, 2021 9:54 AM *To:* Alexandre Petrescu 
> <alexandre.petrescu@gmail.com> *Cc:* its@ietf.org *Subject:* [EXT]
> Re: [ipwave] wish list for CAs for vehicular networks
> 
> Can you comment on this wish list?
> 
> Wish list for CAs for vehicular networks
> 
>>> - the CA must be reachable on IPv6, and their website too.
> 
> Could you please mention why not IPv4 ?
> 
> - the specs of CAs for vehicular networks must be available on IPv6 
> (e.g. on an IPv6 website, FTP directory, or GIT shared space).
> 
> You mean certificate policy. I have the same question. You are 
> specifying the IP protocol for the PKI website. I agree that document  
> must be published and available to PKI users but why IPV6 ?
> 
> - the specs of CA must be implementable independently of other paying 
> sources such as (some) from IEEE or ISO.  For example, the ETSI ITS 
> spec that IMPORTS 1609.2 does not qualify because in the end it is 
> paying.  But the X.509 in RFC 5280 does not rely on other paying 
> documents in order to implement (I think?).
> 
> William could answer you this question better than me because it was  
> already asked by ETSI.
> 
> - the CA must offer OCSP reachability on IPv6.
> 
> I find that all recommandations are related to the use of IPv6 not 
> really the
> 
> security or privacy in C-ITS. By analogy with what you are suggesting, 
> I think  that you would prefer to use IPv6 for the upload of log and 
> download of updates and all V2I communications not only V2PKI 
> connexion.
> 
> Mounira
> 

_______________________________________________
its mailing list
its@ietf.org
https://www.ietf.org/mailman/listinfo/its