Re: [kitten] Adam Roach's Discuss on draft-ietf-kitten-pkinit-alg-agility-05: (with DISCUSS and COMMENT)

[Greg Hudson <[e-mail]>]

On 3/6/19 3:28 AM, Datatracker on behalf of Adam Roach wrote:
> I can see in
> https://www.iana.org/assignments/smi-numbers/smi-numbers.xml#smi-numbers-26
> that the OID 1.3.6.1.5.2 has been reserved for Kerberos v5 objects (a
> reservation that appears to have been copied out of RFC 1700). I also see that
> RFC 4556 uses 1.3.6.1.5.2.3 and defines three nodes (.1, .2, and .3) underneath
> it. Try as I might, I can't find any plausibly authoritative registry that
> tracks the reservation of 1.3.6.1.5.2.3, or of its children 1.3.6.1.5.2.3.1,
> 1.3.6.1.5.2.3.2, and 1.3.6.1.5.2.3.3.

Historically, OIDs under 1.3.6.1.5.2 have been managed out of
https://web.mit.edu/kerberos/krb5-oids/krb5-oids.asn , first by Taylor
Yu and more recently by myself.

> This document also defines 1.3.6.1.5.2.3.6.1, 1.3.6.1.5.2.3.6.2,
> 1.3.6.1.5.2.3.6.3, and 1.3.6.1.5.2.3.6.4 for the various hash algorithms.
> Assuming this list continues to be added to, how will future specifications
> avoid collisions?

These four OIDs were not in the registry file (although their parent was
included); I have added them.

> I have a similar question about 1.3.6.1.5.2.4.5.1.

This OID also appeared to be missing from the registry, and I have added it.

> To be clear: if I understand the situation correctly, I recognize that there
> may be a bigger problem here that is beyond the remit of this document to
> solve; however, I think it would be reasonable to not make the existing problem
> worse. In particular -- and again, I may simply be confused here -- I would
> expect this document to at least ask IANA to create a table at
> https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml that keeps
> track of the children of 1.3.6.1.5.2.3.6.

The Kerberos protocol has a history of managing some number spaces
privately, and others through IANA.  There was an effort to move many of
those number spaces to IANA (draft-ietf-kitten-kerberos-iana-registries)
but it stalled.  It doesn't look like OIDs were part of that effort.