Re: [lamps] ASN.1 Module in draft-ietf-lamps-cmp-updates

["Brockhaus, Hendrik" <[e-mail]>]

> Von: Russ Housley <[e-mail]>
> Gesendet: Mittwoch, 28. April 2021 18:51
> 
> > On Apr 28, 2021, at 12:27 PM, Brockhaus, Hendrik
> <[e-mail]> wrote:
> >
> >
> >> Von: Russ Housley <[e-mail]>
> >>
> >>> On Apr 26, 2021, at 2:52 AM, Brockhaus, Hendrik
> >> <[e-mail]> wrote:
> >>>
> >>>
> >>>> Von: Russ Housley <[e-mail]>
> >>>> Gesendet: Freitag, 23. April 2021 20:06
> >>>>
> >>>> Hendrik:
> >>>>
> >>>> I do not understand how the AlgIdCtrl works.  Can you provide more
> >>>> text in the document?  Is it about the subject public key?  Is it
> >>>> about the signature algorithm to be used by the CA?
> >>>
> >>> The purpose of AlgIdCtrl is to provide the algorithm specification
> >>> the end
> >> entity should use for generating its new key pair.
> >>> We discussed the concept of the new controls in thread
> >>> "dtaft-ietf-lamps-cmp-
> >> updates and rsaKeyLen".
> >>>
> >>> The current text is:
> >>> 5.3.19.16.  Certificate Request Template  This MAY be used by the
> >>> client to get a template containing  requirements for certificate
> >>> request attributes and extensions and  optionally a specification
> >>> for the key pair to generate for a future  certificate request
> >>> operation.
> >>>
> >>> I could change this to:
> >>> 5.3.19.16.  Certificate Request Template  This MAY be used by the
> >>> client to get a template containing  requirements for certificate
> >>> request attributes and extensions.
> >>>  The controls id-regCtrl-algId and id-regCtrl-rsaKeyLen MAY contain
> >>> details on the algorithms whose subject public key values the CA is
> >>> willing to certify.
> >>>
> >>> Is this clearer?
> >>> More details on the usage will be provided in the Lightweight CMP
> >>> Profile
> >> document.
> >>
> >> Yes, but I would like to see another sentence about parameters.  With
> >> ECDSA, for example, the parameters tell which curve the client should use.
> >>
> >
> > I would propose to add the following text.
> >
> > "The id-regCtrl-algId control MAY be used to identify a cryptographic
> > algorithm, see RFC 5820 Section 4.1.2.7, other than rsaEncryption. The
> > algorithm field SHALL identify the cryptographic algorithm. The
> > contents of the optional parameters field will vary according to the algorithm
> identified.
> >
> > The id-regCtrl-rsaKeyLen control SHALL be used for algorithm
> > rsaEncrytion and SHALL contain the intended length of the RSA key."
> 
> This seems fine.  I might also say: For example, when the algorithm is set to id-
> ecPublicKey, the parameters identify the elliptic curve to be used [RFC5480].

I will add that sentence. Thanks!

Hendrik