Re: [pkix] [Errata Held for Document Update] RFC7030 (4384)

[Russ Housley <[e-mail]>]

> 
>> The following errata report has been held for document update for 
>> RFC7030, "Enrollment over Secure Transport".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> https://www.rfc-editor.org/errata/eid4384
>> 
>> --------------------------------------
>> Status: Held for Document Update
>> Type: Technical
>> 
>> Reported by: Pierce Leonberger <[e-mail]>
>> Date Reported: 2015-06-02
>> Held by: Roman Danyliw (IESG)
>> 
>> Section: 4.5.2
>> 
>> Original Text
>> -------------
>> CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
>> 
>> AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }
>> 
>> Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
>>      type   ATTRIBUTE.&id({IOSet}),
>>      values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type}) }
>> 
>> Corrected Text
>> --------------
>> AttrOrOID ::= CHOICE {
>>       oid OBJECT IDENTIFIER,
>>       attribute Attribute{YouNeedToDefineOrReferenceAnObjectSet}
>> }
>> 
>> Notes
>> -----
>> 1. The AttrOrOID CHOICE was started with a '(' versus a '{'.
>> 
>> 2. Attribute{} is a parameterized type and you are missing the parameter reference within the AttrOrOID CHOICE for "attribute".
> 
>   "YouNeedToDefined...." needs to be a list of OIDs I believe. Since this is a request to someone on how to generate a CSR, the OIDs should be the ones that would be useful when giving such instruction. For instance:
> 
> [JLS] YouNeedToDefined needs to be an ObjectSet of Attributes.  An attribute is going to have both an OID and a Type in it.
> 
>   - "Generate a CSR with a public key from p384, add your serialNumber
>      as an extReq, include challengePassword, and sign the whole thing
>      with ECDSA and SHA384"
> 
>   - "Generate a CSR with RSA and a key that is 4096 bits, include
>      challengePassword and sign the whole thing with RSA and SHA512"
> 
> So how about this:
> 
>   AttrOrOID ::= CHOICE {
>        oid OBJECT IDENTIFER,
>        attribute AttrSet
>   }
> 
>   AttrSet ATTRIBUTE ::= { challengePassword, id-ecPublicKey, rsaEncryption,
>                           extReq, ecdsa-with-SHA256, ecdsa-with-SHA384,
>                           ecdsa-with-SHA512, SHA256, SHA384, SHA512, ... }
> 
> [JLS]
> Items like challengePassword can be imported from RFC 2985.  However id-ecPublicKey is an OID so the ATTRIBUTE would need to be defined
> att-ecPublicKey ::= ATTRIBUTE ::= { WITH SYNTAX ECParameters ID id-ecPublicKey }
> 
> Making an ASN.1 module would shake out which are needed to be defined as attributes.  I would use SHA256 in the oid choice myself.  Having an value set there would be useful so that people know which values go in which choices.

Please see the ASN.1 module in draft-ietf-lamps-rfc7030est-clarify.

Russ