[lamps] Re: WGLC for draft-ietf-lamps-csr-attestation-18

[Michael StJohns <[e-mail]>]

Hi Russ - to close out the ASN1 specific comments  -

Referencing X.680, Appendix A, I get this for Hint: (these both compile 
at the asn1.io playground).

    -- At least 2 and not more than 10 DNS labels including the TLD. The
    last label has at least 2 letters. Optional port specification.
    -- Basically a URI with just the DNS name and an optional port and
    without everything else.
    Hint ::= IA5String (PATTERN
    "(([a-z]|[A-Z])\w#(,63)\.)#(1,9)([a-z]|[A-Z])\w#(1,63)(:\d#(1,5))?")

    Alternately (just constraining the included characters):

    Hint ::= IA5String (FROM ("a".."z" | "A".."Z" | "0".."9" | ".:"))

Assuming the change to [A]ncillary from [H]int  and not making Hint the 
default- this results in the following changes to the EVIDENCE-STATEMENT 
definitions in appendix A:

EvidenceStatementSet EVIDENCE-STATEMENT ::= {
      --- TPM 2.0
      { Tcg-attest-tpm-certify IDENTIFIED BY tcg-attest-tpm-certify
                               ANCILLARY TYPE Hint IS preferredPresent },
      ...,

      --- PSA
      { OCTET STRING IDENTIFIED BY { 1 3 6 1 5 5 7 1 99 }
                     ANCILLARY TYPE Hint IS preferredPresent }
    }



and in Appendix B:

tcgDiceCmwEvidenceStatement EVIDENCE-STATEMENT ::= {
DiceConceptualMessageWrapper IDENTIFIED BY 
tcg-dice-conceptual-message-wrapper
ANCILLARY TYPE Hint IS preferredPresent
}


tcgDiceTcbInfoEvidenceStatementES EVIDENCE-STATEMENT ::=  {
                   DiceTcbInfo IDENTIFIED BY tcg-dice-TcbInfo
                               ANCILLARY TYPE Hint is preferredPresent
                  }

-- or "required" depending...


Another nit - 1.3.6.2.5.5.7.1 certificate extensions registry... 
probably not the right place for EVIDENCE-STATEMENT registrations - even 
for an example?

Later, Mike

On 5/4/2025 7:46 PM, StJohns, Michael wrote:
> With the exception of the item you note (a default type for the 
> secondary- “hint” field and its presence indication), that’s correct.  
> I used “ancillary” where you have “hint” because the general case is 
> just additional data specific to the evidence type.
>
> For reference this uses the object id to identify the type (and 
> possibly presence) of both the main field and the ancillary.
>
> Given the text describing the IA5String hint field, I’d define the 
> Hint type using either the FROM or PATTERN constraint - ideally the 
> latter.  E.G.
>
> — where you have MikesHint use this instead
> Hint ::= IA5String (FROM 
> (“0..9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.:”))
>
> Or
>
> Hint ::= IA5String (PATTERN “<tbd>”)
>
> Mike
>
>
>
> On Sun, May 4, 2025 at 18:10 Russ Housley <[e-mail]> wrote:
>
>
>     Mike:
>
>     I could not get your ASN.1 to compile.  Please look at this.  Does
>     it do what you are suggesting?
>
>     I realize that I removed the DEFAULT type of the Hint being an
>     OCTET STRING, but I think the rest is captured.
>
>     If this captures your idea, then the authors can respond about
>     whether they like it.
>
>     Russ
>
>     = = = = = = =
>
>     FooBarModule
>     DEFINITIONS IMPLICIT TAGS ::= BEGIN
>
>     EVIDENCE-STATEMENT ::= CLASS {
>       &id          OBJECT IDENTIFIER UNIQUE,
>       &Type,
>       &hintPresent ParamOptions DEFAULT absent,
>       &HintType    OPTIONAL
>     } WITH SYNTAX {
>       &Type IDENTIFIED BY &id
>       [HINT TYPE &HintType ARE &hintPresent]
>     }
>
>     EvidenceStatementSet EVIDENCE-STATEMENT ::= {
>        mikesEvidenceStatement | otherEvidenceStatement, ... }
>
>     EvidenceStatements ::= SEQUENCE SIZE (1..MAX) OF EvidenceStatement
>
>     EvidenceStatement ::= SEQUENCE {
>        type EVIDENCE-STATEMENT.&id({EvidenceStatementSet}),
>        stmt EVIDENCE-STATEMENT.&Type({EvidenceStatementSet}{@type}),
>        hint
>     EVIDENCE-STATEMENT.&HintType({EvidenceStatementSet}{@type}) OPTIONAL }
>
>     ParamOptions ::= ENUMERATED {
>        required,         -- Parameters MUST be encoded in structure
>        preferredPresent, -- Parameters SHOULD be encoded in structure
>        preferredAbsent,  -- Parameters SHOULD NOT be encoded in structure
>        absent,           -- Parameters MUST NOT be encoded in structure
>        inheritable,      -- Parameters are inherited if not present
>        optional,         -- Parameters MAY be encoded in the structure
>        ... }
>
>     mikesEvidenceStatement EVIDENCE-STATEMENT ::= {
>        MikesASN1Structure IDENTIFIED BY id-mikes-statement
>        HINT TYPE MikesHint ARE required }
>
>     id-mikes-statement OBJECT IDENTIFIER ::= { 1 1 1 1 1 1 }
>
>     MikesASN1Structure ::= OCTET STRING
>
>     MikesHint ::= IA5String
>
>     otherEvidenceStatement EVIDENCE-STATEMENT ::= {
>        OtherStructure IDENTIFIED BY id-other-statement }
>
>     id-other-statement OBJECT IDENTIFIER ::= { 2 2 2 2 2 2 }
>
>     OtherStructure ::= PrintableString
>
>     END
>