Re: [lamps] CMP Update of CertificationRequest

[Russ Housley <[e-mail]>]

> On May 25, 2021, at 10:45 AM, Brockhaus, Hendrik <[e-mail]> wrote:
> 
> Russ
> 
>> Von: Russ Housley <[e-mail]>
>> 
>> However, RFC 6402 did choose to locally define CertificationRequest.  I believe
>> this was done because there was a place to IMPORT for the newer ASN.1 syntax,
>> but not the older.  That way, the two modules are defining exactly the same
>> things, even though the newer syntax could IMPORT it from RFC 2986.
>> 
>> Maybe we should continue to IMPORT from RFC 2986 in the newer ASN.1
>> syntax, and define locally in the older ASN.1 syntax, with a comment that this
>> structure matches the one defined in RFC 2986.  This definition can be lifted
>> from RFC 6402, where Jim Schaad already did that work.
> 
> RFC 4210 Appendix F imports CertificationRequest from RFC 2986.
> 
>         CertificationRequest
>                FROM PKCS-10 {iso(1) member-body(2)
>                              us(840) rsadsi(113549)
>                              pkcs(1) pkcs-10(10) modules(1) pkcs-10(1)}
> 
>         -- (specified in RFC 2986 with 1993 ASN.1 syntax and IMPLICIT
>         -- tags).  Alternatively, implementers may directly include
>         -- the [PKCS10] syntax in this module
> 
> RFC 5912 Section 9 imports CertificationRequest from the updated PKCS#10 module from Section 5. Jim already points the used to possibly directly add the syntax here.
> 
> CertificationRequest
> FROM PKCS-10
>       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
>       mechanisms(5) pkix(7) id-mod(0) id-mod-pkcs10-2009(69)}
> -- (specified in RFC 2986 with 1993 ASN.1 syntax and IMPLICIT
> -- tags).  Alternatively, implementers may directly include
> -- the [PKCS10] syntax in this module
> 
> Do you think we should change this and directly add the new syntax from RFC 6402 to modules in CMP Updates?

Suggestion:

New ASN.1 syntax: IMPORT from RFC 2986

Old ASN.1 syntax: IMPORT from RFC 6402

Russ