Re: [Netconf] PKCS7 --> CMS

[Russ Housley <[e-mail]>]

Kent:

Yes.  This is the approach takes for signed firmware packages in RFC 4108.

Russ


> On Feb 6, 2018, at 3:40 PM, Kent Watsen <[e-mail]> wrote:
> 
> Russ,
> 
> I like it.  I didn't know that it was possible to set the top-level content
> type value like that.  Is the net-result still considered a CMS structure?
> 
> Thanks,
> Kent
> 
> 
> ===== original message =====
> 
> I suggest that ContentInfo is always present, then for the signed case:
> 
>      ContentInfo {
>        contentType          id-signedData, -- (1.2.840.113549.1.7.2)
>        content              SignedData
>      }
> 
>      SignedData {
>        version              CMSVersion, -- always set to 3
>        digestAlgorithms     DigestAlgorithmIdentifiers, -- Only one
>        encapContentInfo     EncapsulatedContentInfo,
>        certificates         CertificateSet, -- Signer cert. path
>        crls                 CertificateRevocationLists, -- Optional
>        signerInfos          SET OF SignerInfo -- Only one
>      }
> 
>      SignerInfo {
>        version              CMSVersion, -- always set to 3
>        sid                  SignerIdentifier,
>        digestAlgorithm      DigestAlgorithmIdentifier,
>        signedAttrs          SignedAttributes, -- Required
>        signatureAlgorithm   SignatureAlgorithmIdentifier,
>        signature            SignatureValue,
>        unsignedAttrs        UnsignedAttributes -- Optional
>      }
> 
>      EncapsulatedContentInfo {
>        eContentType         <your-netconf-content-type>
>        eContent             OCTET STRING
>      }                            -- Contains the content
> 
> The unsigned case:
> 
>      ContentInfo {
>        contentType          <your-netconf-content-type>
>        content              -- Contains the content
>      }
> 
> Russ
> 
> 
>> On Feb 6, 2018, at 11:53 AM, Kent Watsen <[e-mail]> wrote:
>> 
>> Hi Russ,
>> 
>> I'm looking into switching from PKCS7 to CMS change in the NETCONF
>> zerotouch draft.  This update would be similar to the change to the
>> ANIMA voucher draft.  However, I noticed that RFC 5652 says in 
>> Section 5.2:
>> 
>>  "In the degenerate case where there are no signers, the
>>  EncapsulatedContentInfo value being "signed" is irrelevant.  In this
>>  case, the content type within the EncapsulatedContentInfo value being
>>  "signed" MUST be id-data (as defined in Section 4), and the content
>>  field of the EncapsulatedContentInfo value MUST be omitted."
>> 
>>  Note, this text is similar to the last paragraph in RFC 2315 Section 
>>  9.1, though there it is just a "recommendation" that the value be
>>  omitted.
>> 
>> This is a problem for the NETCONF zerotouch draft, where we currently
>> have a PKCS7 object that is sometimes signed.  We choose this approach
>> because then, in all cases, a PKCS7 object is being communicated.  But
>> it's no longer allowed in CMS?
>> 
>> Questions:
>> 
>> 1) Can the zerotouch draft explicitly allow the "eContent" field 
>>  again for the degenerate case?
>> 
>> 2) If having a eContent value for the degenerate case is no longer
>>  allowed, can we use it as grounds for not migrating to CMS?
>> 
>> 3) Are there any other generic "envelop" structure that can be 
>>  "sometimes signed"?
>> 
>> 
>> Thanks,
>> Kent
>> 
>> 
>> 
> 
> 
>