From nobody Tue Nov 9 09:25:01 2021 Return-Path: X-Original-To: spasm@ietfa.amsl.com Delivered-To: spasm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 305AC3A0DAE for ; Tue, 9 Nov 2021 09:24:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yNE1jo404-NB for ; Tue, 9 Nov 2021 09:24:54 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B6463A0DA5 for ; Tue, 9 Nov 2021 09:24:54 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 92C70300BE1 for ; Tue, 9 Nov 2021 12:24:55 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 8TDDlKI67sWJ for ; Tue, 9 Nov 2021 12:24:53 -0500 (EST) Received: from a860b60074bd.fios-router.home (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 0D627300BF7; Tue, 9 Nov 2021 12:24:52 -0500 (EST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.21\)) From: Russ Housley In-Reply-To: Date: Tue, 9 Nov 2021 12:24:49 -0500 Cc: LAMPS WG , "david.von.oheimb@siemens.com" , John Gray Content-Transfer-Encoding: quoted-printable Message-Id: <4F089FDA-977F-4EDC-BD65-DEBE74722659@vigilsec.com> References: To: "Brockhaus, Hendrik" X-Mailer: Apple Mail (2.3445.104.21) Archived-At: Subject: Re: [lamps] Changes to pre-registered OIDs X-BeenThere: spasm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Nov 2021 17:24:59 -0000 Hendrik: RE: Example 1 and Example 3: Once the assignment is made in the IANA registry, I am strongly opposed = to assigning a different ASN.1 type with that OID. Doing so would lead = to interoperability issues. If a different type is needed, then a new = OID should be assigned. RE: Example 2: Changing (or adding) a description has been done. This is a NOTE that = gets added to the IANA registry. For example: Note: id-alg-dhPop-sha1 is also known as id-alg-dh-pop. In this case, the one used in the newest RFC appears in the IANA table, = and the older one is explained in the note. Also, the ASN.1 module = defines both: id-it-oldTrustAnchor OBJECT IDENTIFIER ::=3D { 1 3 6 1 5 5 7 4 20 } id-it-rootCaCert OBJECT IDENTIFIER ::=3D id-it-oldTrustAnchor=20 Russ > On Nov 9, 2021, at 12:06 PM, Brockhaus, Hendrik = wrote: >=20 > Russ >=20 > In my talk yesterday I asked, if it is possible to perform some = changes to the pre-registered OIDs in CMP Updates. > I understood that this is not supported. To more clearly understand = the restrictions, I provide some examples. >=20 > Example 1, changing the OID decimal value. > 20 id-it-rootCaCert --> 18 id-it-rootCaCert (and moving = id-it-rootCaKeyUpdate and id-it-certReqTemplate one position behind) > This is to rearrange the OID addressing the change from providing the = root ca cert in the genm body instead of the generalInfo header field. = (CMP Updates, Section 2.14) > I understood changing the OID decimal value is not possible, right? >=20 > Example 2, changing the OID Description. > 20 id-it-rootCaCert --> 20 id-it-oldTrustAnchor > This is to rename the root ca cert in alignment with its extended = scope also allowing a publicKey only as trust anchor instead of a = certificate. (CMP Updates Section 2.14) > Is this possible? >=20 > Example 3, changing the OIDs ASN.1 syntax. > GenRep: {id-it 17}, SEQUENCE SIZE (1..MAX) OF > CMPCertificate | < absent > > --> > GenRep: {id-it 17}, SEQUENCE SIZE (1..MAX) OF > CaCertsContent | < absent > > CaCertsContent ::=3D SEQUENCE { > intermediateCaCerts [0] CMPCertificate, > trustAnchors [1] CMPCertificate } > This should make it possible to differentiate between trust anchors = like root ca certificates and intermediate ca certificates. (not = reflected in CMP Updates now, but discussed internally) > Is this possible? >=20 > We can definitely live without all these changes. It would finally = make the final draft a little more perfect. :-) > But my main goal remains to finalize the document now. >=20 > Hendrik