Re: [pkix] I-D Action:draft-ietf-pkix-new-asn1-07.txt

[Paul Hoffman <[e-mail]>]

At 3:10 PM -0400 8/31/09, Sean Turner wrote:
>During the updates to RFC 3281 it was noted that the wrong OID was used for id-at-clearance.  We fixed this in draft-ietf-pkix-3281bis.  I would like to make sure we incorporate the same fix in draft-ietf-pkix-new-asn1.  If we don't, then we'll need to do another ID that incorporates this one change in an '02 ASN.1 module.  What I'm proposing is that make the following change:
>
>OLD:
>
> id-at-clearance              OBJECT IDENTIFIER ::=
>              { joint-iso-ccitt(2) ds(5) module(1)
>                selected-attribute-types(5) clearance (55) }
>
>NEW:
>
>  id-at-clearance              OBJECT IDENTIFIER ::= {
>      joint-iso-ccitt(2) ds(5) attributeType(4) clearance (55) }
>
>    -- Uncomment the following declaration and comment the above line if
>    -- using the id-at-clearance attribute as defined in [RFC3281]
>
>    --  id-at-clearance              OBJECT IDENTIFIER ::= {
>    --    joint-iso-ccitt(2) ds(5) module(1) selected-attribute-types(5)
>    --    clearance (55) }

draft-ietf-pkix-new-asn1 has a module for RFC 3281. Jim and I believe that the module in our draft matches RFC 3281 correctly.

We can add another module that reflects draft-ietf-pkix-3281update-05.txt  (there is no draft-ietf-pkix-3281bis). However, we do not have any Internet Drafts in draft-ietf-pkix-new-asn1, and I personally think that it is unwise for us to add one at this late state. We could also wait for draft-ietf-pkix-3281update-05.txt to be published as an RFC and add a module for it to draft-ietf-pkix-new-asn1.

Personally, I think it is wrong to change the module for RFC 3281 to change bits on the wire from what is represented in RFC 3281.