Re: [lamps] Changes to pre-registered OIDs

[Russ Housley <[e-mail]>]

Hendrik:

RE: Example 1 and Example 3:

Once the assignment is made in the IANA registry, I am strongly opposed to assigning a different ASN.1 type with that OID.  Doing so would lead to interoperability issues.  If a different type is needed, then a new OID should be assigned.

RE: Example 2:

Changing (or adding) a description has been done.  This is a NOTE that gets added to the IANA registry.  For example:

   Note: id-alg-dhPop-sha1 is also known as id-alg-dh-pop.

In this case, the one used in the newest RFC appears in the IANA table, and the older one is explained in the note.  Also, the ASN.1 module defines both:

   id-it-oldTrustAnchor OBJECT IDENTIFIER ::= { 1 3 6 1 5 5 7 4 20 }

   id-it-rootCaCert OBJECT IDENTIFIER ::= id-it-oldTrustAnchor 

Russ


> On Nov 9, 2021, at 12:06 PM, Brockhaus, Hendrik <[e-mail]> wrote:
> 
> Russ
> 
> In my talk yesterday I asked, if it is possible to perform some changes to the pre-registered OIDs in CMP Updates.
> I understood that this is not supported. To more clearly understand the restrictions, I provide some examples.
> 
> Example 1, changing the OID decimal value.
> 20       id-it-rootCaCert --> 18       id-it-rootCaCert   (and moving id-it-rootCaKeyUpdate and id-it-certReqTemplate one position behind)
> This is to rearrange the OID addressing the change from providing the root ca cert in the genm body instead of the generalInfo header field. (CMP Updates, Section 2.14)
> I understood changing the OID decimal value is not possible, right?
> 
> Example 2, changing the OID Description.
> 20       id-it-rootCaCert --> 20       id-it-oldTrustAnchor
> This is to rename the root ca cert in alignment with its extended scope also allowing a publicKey only as trust anchor instead of a certificate. (CMP Updates Section 2.14)
> Is this possible?
> 
> Example 3, changing the OIDs ASN.1 syntax.
>      GenRep:    {id-it 17}, SEQUENCE SIZE (1..MAX) OF
>                             CMPCertificate | < absent >
> -->
>      GenRep:    {id-it 17}, SEQUENCE SIZE (1..MAX) OF
>                             CaCertsContent | < absent >
>      CaCertsContent ::= SEQUENCE {
>        intermediateCaCerts          [0] CMPCertificate,
>        trustAnchors              [1]  CMPCertificate }
> This should make it possible to differentiate between trust anchors like root ca certificates and intermediate ca certificates. (not reflected in CMP Updates now, but discussed internally)
> Is this possible?
> 
> We can definitely live without all these changes. It would finally make the final draft a little more perfect.  :-)
> But my main goal remains to finalize the document now.
> 
> Hendrik