Re: [pkix] Concluding OCSP Agility

[Stefan Santesson <[e-mail]>]

A new draft has been submitted

http://tools.ietf.org/rfcdiff?url2=draft-ietf-pkix-ocspagility-10.txt

In particular, please check the change in section 8.1. It's revision was
requested by IESG, but I'm not entirely sure what the original text
intended to say.

I.e:
   "In such
   circumstances the responder MUST NOT generate a signature for a
   signing mechanism that is considered unacceptably insecure."


Jim, it would be great if you could check if the ASN.1 changes are OK.

/Stefan




On 11-03-11 11:32 AM, "Stefan Santesson" <[e-mail]> wrote:

>I made an error in the suggested ASN.1
>
>It should not be SMIMECapabilities, it should be SMIMECapability.
>SMIMECapabilities is a SEQUENCE OF SMIMECapability. There is no reason for
>such sequence in the structure.
>
>The correct ASN.1 should be:
>
>     PreferredSignatureAlgorithm ::= SEQUENCE {
>        sigIdentifier        AlgorithmIdentifier,
>        pubKeyAlgIdentifier  SMIMECapability OPTIONAL
>        }
>
>
>/Stefan
>
>
>On 11-03-09 4:33 PM, "Stephen Kent" <[e-mail]> wrote:
>
>>At 1:41 AM +0100 3/8/11, Stefan Santesson wrote:
>>>The OCSP agility draft sits with the IESG with an "new ID needed"
>>>status.
>>>
>>>However, I don't think we got a clear consensus on whether to use
>>>Algorithm identifier or SMIMECapabilities.
>>>
>>>The structure at hand is:
>>>
>>>PreferredSignatureAlgorithms ::= SEQUENCE OF
>>>                                        PreferredSignatureAlgorithm
>>>       PreferredSignatureAlgorithm ::= SEQUENCE {
>>>          sigIdentifier   AlgorithmIdentifier,
>>>          certIdentifier  AlgorithmIdentifier OPTIONAL
>>>          }
>>>
>>>
>>>There is now a new PKIX draft for S/MIME Capabilities for public key
>>>definitions which may help move forward on this issue.
>>>
>>>The primary proposal as I recall this is to change the
>>>certIdentifier into SMIMECapabilities as that would allow better
>>>specification of public keys and their parameters.
>>>
>>>Secondly I recall that we should change the name of certIdentifier
>>>to something better as it sounds like an identifier of a certificate
>>>which it is not.
>>>More suitable would be pubKeyAlgIdentifier since this is an
>>>identifier of the preferred algorithm of the public key in the
>>>responders certificate.
>>>
>>>The changed syntax would then be:
>>>
>>>       PreferredSignatureAlgorithm ::= SEQUENCE {
>>>          sigIdentifier        AlgorithmIdentifier,
>>>          pubKeyAlgIdentifier  SMIMECapabilities OPTIONAL
>>>          }
>>>
>>>Would the list agree to this change?
>>>
>>>/Stefan
>>
>>I am comfortable with this change.
>>
>>Steve
>>_______________________________________________
>>pkix mailing list
>>[e-mail]
>>https://www.ietf.org/mailman/listinfo/pkix
>
>
>_______________________________________________
>pkix mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/pkix