[lamps] strugling with CSRAttrs

[Michael Richardson <[e-mail]>]

Sean, sorry to be asking this with less than 24h to ID cut-off.
I didn't want to post an updated ID until I had example code that produced
what I *thought* you are suggesting.  Moving a SEQ/SET around isn't that
hard... only now I've confused myself.

We had:

   CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID

   AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER,
                         attribute Attribute }

   Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
        extType  ATTRIBUTE.&id({IOSet}),
        extAttr  SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type})
   }

with the understanding that extAttr could be a SET of Extensions.
Each Extension is given by:

   Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension

   Extension  ::=  SEQUENCE  {
        extnID      OBJECT IDENTIFIER,
        critical    BOOLEAN DEFAULT FALSE,
        extnValue   OCTET STRING
                    -- contains the DER encoding of an ASN.1 value
                    -- corresponding to the extension type identified
                    -- by extnID
        }


1) I'm not sure why I need a SET of a Sequence, unless your intent was that
   extAttr could be an *Extension* ??  I'm gonna go with yes here, but I
   didn't code that yet.

2) I think that extnID would be things like subjectAltName,
   i.e. OID: 2.5.29.17

But, if so, what is extType for this?

ASN1 that I have right now, where I've put subjectAltName in twice:

obiwan-[projects/pandora/fountain](2.6.6) mcr 10396 %dumpasn1 tmp/csr_bulb1.der
  0  84: SEQUENCE {
  2  82:   SEQUENCE {
  4   3:     OBJECT IDENTIFIER subjectAltName (2 5 29 17)  <--- WHAT GOES HERE?
  9  75:     SET {
 11  73:       SEQUENCE {   <--- SEQUENCE here might be undesired.
 13   3:         OBJECT IDENTIFIER subjectAltName (2 5 29 17)
 18   3:         [0] {
 20   1:           BOOLEAN TRUE
       :           }
 23  61:         SEQUENCE {
 25  59:           [0] {
 27  57:             UTF8String
       :               '[e-mail]'
       :               'ample.com'
       :             }
       :           }
       :         }
       :       }
       :     }
       :   }

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide