Re: [pkix] [Errata Held for Document Update] RFC7030 (4384)

   Hi there,

On 8/19/20 12:58 PM, RFC Errata System wrote:
> The following errata report has been held for document update
> for RFC7030, "Enrollment over Secure Transport".
>
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid4384
>
> --------------------------------------
> Status: Held for Document Update
> Type: Technical
>
> Reported by: Pierce Leonberger <pierce.leonberger@baesystems.com>
> Date Reported: 2015-06-02
> Held by: Roman Danyliw (IESG)
>
> Section: 4.5.2
>
> Original Text
> -------------
> CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
>
> AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }
>
> Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
>       type   ATTRIBUTE.&id({IOSet}),
>       values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type}) }
>
> Corrected Text
> --------------
> AttrOrOID ::= CHOICE {
>        oid OBJECT IDENTIFIER,
>        attribute Attribute{YouNeedToDefineOrReferenceAnObjectSet}
> }
>
> Notes
> -----
> 1. The AttrOrOID CHOICE was started with a '(' versus a '{'.
>
> 2. Attribute{} is a parameterized type and you are missing the parameter reference within the AttrOrOID CHOICE for "attribute".

   "YouNeedToDefined...." needs to be a list of OIDs I believe. Since this
is a request to someone on how to generate a CSR, the OIDs should be the
ones that would be useful when giving such instruction. For instance:

   - "Generate a CSR with a public key from p384, add your serialNumber
      as an extReq, include challengePassword, and sign the whole thing
      with ECDSA and SHA384"

   - "Generate a CSR with RSA and a key that is 4096 bits, include
      challengePassword and sign the whole thing with RSA and SHA512"

So how about this:

   AttrOrOID ::= CHOICE {
        oid OBJECT IDENTIFER,
        attribute AttrSet
   }

   AttrSet ATTRIBUTE ::= { challengePassword, id-ecPublicKey, rsaEncryption,
                           extReq, ecdsa-with-SHA256, ecdsa-with-SHA384,
                           ecdsa-with-SHA512, SHA256, SHA384, SHA512, ... }

   Would this work? This is basically what I implemented in my EST reference
design (plus some extra stuff like for extReq like macAddress, 
favoriteDrink,
etc that might be considered part of "...").

   regards,

   Dan.

> 3. You need to define or reference the object set to be used in #2.
>
> Highly recommend you create an ASN.1 Module as part of this specification.  This will make it clear which specifications (and the versions there of) you are importing types from (i.e. Attribute{}) and the tagging that should be used (module level).  If you need to define a new object set for #3 then this new module would be the perfect home for it.
>
> --------------------------------------
> RFC7030 (draft-ietf-pkix-est-09)
> --------------------------------------
> Title               : Enrollment over Secure Transport
> Publication Date    : October 2013
> Author(s)           : M. Pritikin, Ed., P. Yee, Ed., D. Harkins, Ed.
> Category            : PROPOSED STANDARD
> Source              : Public-Key Infrastructure (X.509)
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix