Re: [pkix] [Technical Errata Reported] RFC3029 (6444)

[Russ Housley <[e-mail]>]

I guess I should have held off on reporting this ASN.1 error.  Once I corrected it, I discovered two errors that I do not know how to fix.

There is an implementation somewhere because Appendix F contains examples.  I do not know how the implementer got around these two problems.


PROBLEM 1:

CertEtcToken ::= CHOICE {
     certificate                  [0] IMPLICIT Certificate ,
     esscertid                    [1] ESSCertId ,
     pkistatus                    [2] IMPLICIT PKIStatusInfo ,
     assertion                    [3] ContentInfo ,
     crl                          [4] IMPLICIT CertificateList,
     ocspcertstatus               [5] IMPLICIT CertStatus,
     oscpcertid                   [6] IMPLICIT CertId ,
     oscpresponse                 [7] IMPLICIT OCSPResponse,
     capabilities                 [8] SMIMECapabilities,
     extension                    Extension{{ExtensionSet}}
}

CertEtcToken is a CHOICE with tags 0 through 8, but CertStatus CHOICE with tags 0 through 2.  You cannot nest a CHOICE in another CHOICE is the IMPLICIT tags overlap.

The use of EXPLICIT tagging would have solved the problem, but the authors clearly preferred IMPLICIT tags.


PROBLEM 2

DigestInfo ::= SEQUENCE {
    digestAlgorithm   DigestAlgorithmIdentifier,
    digest            Digest
}

Data ::= CHOICE {
      message           OCTET STRING ,
      messageImprint    DigestInfo,
      certs             SEQUENCE SIZE (1..MAX) OF
                            TargetEtcChain
}

DigestInfo is a SEQUENCE, and certs is a SEQUENCE, so the two have the same tag.  A recipient cannot tell which one the sender intended.

Russ



> On Feb 26, 2021, at 3:54 PM, RFC Errata System <[e-mail]> wrote:
> 
> The following errata report has been submitted for RFC3029,
> "Internet X.509 Public Key Infrastructure Data Validation and Certification Server Protocols".
> 
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid6444
> 
> --------------------------------------
> Type: Technical
> Reported by: Russ Housley <[e-mail]>
> 
> Section: Appendix E
> 
> Original Text
> -------------
>  GeneralName, PolicyInformation
>  FROM PKIX1Implicit88 {iso(1) identified-organization(3)
>  dod(6) internet(1) security(5) mechanisms(5) pkix(7)
>  id-mod(0) id-pkix1-implicit-88(2)}
> 
> Corrected Text
> --------------
>  GeneralName, GeneralNames, PolicyInformation
>  FROM PKIX1Implicit88 {iso(1) identified-organization(3)
>  dod(6) internet(1) security(5) mechanisms(5) pkix(7)
>  id-mod(0) id-pkix1-implicit-88(2)}
> 
> Notes
> -----
> The ASN.1 Module uses GeneralName and GeneralNames, but only one of them is IMPORTed.  The suggested fix IMPORTS both of GeneralName and GeneralNames.
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC3029 (draft-ietf-pkix-dcs-07)
> --------------------------------------
> Title               : Internet X.509 Public Key Infrastructure Data Validation and Certification Server Protocols
> Publication Date    : February 2001
> Author(s)           : C. Adams, P. Sylvester, M. Zolotarev, R. Zuccherato
> Category            : EXPERIMENTAL
> Source              : Public-Key Infrastructure (X.509)
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG