Return-Path: X-Original-To: spasm@mail2.ietf.org Delivered-To: spasm@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 2264C24A7127 for ; Sun, 4 May 2025 19:22:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=nthpermutation-com.20230601.gappssmtp.com Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hoaRVjWSXxfv for ; Sun, 4 May 2025 19:22:09 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 3C72E24A711F for ; Sun, 4 May 2025 19:22:09 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id af79cd13be357-7c56a3def84so405650485a.0 for ; Sun, 04 May 2025 19:22:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nthpermutation-com.20230601.gappssmtp.com; s=20230601; t=1746411729; x=1747016529; darn=ietf.org; h=in-reply-to:content-language:references:cc:to:from:subject :user-agent:mime-version:date:message-id:from:to:cc:subject:date :message-id:reply-to; bh=Q+t4viDvAANYc9GgL2Ttt5Y0xUaqIhHmyB3LyKzm6sc=; b=wBKe+7Vg4maum7EI4VBkNR44PKElP7h5jWEfhBP3n4y9SrYJc5u5VRlPzLcyP+iR40 5G3iCgR+BFqpghuaB8ROcJnGFxlDBnjk7bfDdu10vRoZqe7UVNyGYLQteoGV0a5wf5Ya W+1Uag4XyBM3FsdN+gbKPsJ8XCp37gwnSOZ3534RGixDFo/+kyD7Yz4MADmLA1aJYVXH f3wO9DflZQJjKJjYAvbKcQ8wJ3FoyO+73a54KrUDmQH+cVSCMjLniFXKihvHGEfP/Q3e mRxLPrc8eW8+Ee/ewTAW2/NqQ9ceTfZVW/Yi4lIxtKD9+/y8HbObtajSn+qmK7EgTliy JLlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1746411729; x=1747016529; h=in-reply-to:content-language:references:cc:to:from:subject :user-agent:mime-version:date:message-id:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=Q+t4viDvAANYc9GgL2Ttt5Y0xUaqIhHmyB3LyKzm6sc=; b=B9Act75k5EbqXE1Kf1Gv2mWtpURwwv9cy6r2VOyv0jqx7y4KJJ4K75j3itGGu7GmJW 25D+S5N4zaLrGeo247WxjIfDnIHLDyi8sz1nfpkE6793nWbpRbBnlULoo70Q9cKFo+Il TbNREJbnGG+ngMBrkFHiDV2gVcJlBniv6fCimWh5NMyoJVlD4qd2JMrT850LDgcv7nUg Z5fKzeeQymSfQ1zlUoOzNQNtgrRm6PPi7p+Dlt01GAq8rQLNFEQONNO+Rkax3ZzExu5c 1p6O1gNv9Uci4/eEBWft3tYp+j/ocG9ywIQ2XEx2f+9XyXyw51O7uTVSqPZucrGPT3fm 5BIw== X-Gm-Message-State: AOJu0YxgXKtqPPHPKS6b8kjy8UdVFOTguNtksXLWc5ifQsqnfza+JefN VkgdboZmrmnl5AO/aOYwCtML4VDmse45etSoTFlXV1JgYvWcB0zSWQsCjNi0yH6CJNkvqxnQdnt PCU4= X-Gm-Gg: ASbGnctvGXcZPXSFTUhD37uO061LJ9zSD22emtL+Dk0ZWzbuC0ncEWmJJsjkf09Y5PT jErPjmR45QzgObw4LcjQzTnKwKuStMyfm4sNvfysUx5HpFaDZAiUTD5zaLiRzUxA0DUqXVnJaJf VvqB5wMVEj7gmhONS4Y2A12kXlsiZWcQsyu9s80/DMaag6nRDLZ80UnItczvYPX72Vmt4Obp0qZ NNI8MpgFKT43vxaxQeX/reL1di0WQztJN6ynOXT6FQ+OGvKiTFmqmdQs7npjOqFe6ciGiWU3UkG HcMyRNYThg0DU55o+vEy4HyHNDx00Olt4kNN3aJ9eKQHn49KFXxDU41xReOZSlcI5RQFNFRjEH2 xMC1Adw== X-Google-Smtp-Source: AGHT+IHbIWSFxmdKFEsC7bD6MKJRKemM4otXOElC65HzECOleZyu6aoB9nkMk1Hc5j77gklTypcl7Q== X-Received: by 2002:a05:620a:4085:b0:7c7:a5e6:d287 with SMTP id af79cd13be357-7cadfeda3e2mr1105503385a.52.1746411728658; Sun, 04 May 2025 19:22:08 -0700 (PDT) Received: from [192.168.1.40] (pool-108-48-44-44.washdc.fios.verizon.net. [108.48.44.44]) by smtp.gmail.com with ESMTPSA id af79cd13be357-7cadb0c550fsm358068185a.37.2025.05.04.19.22.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 04 May 2025 19:22:08 -0700 (PDT) Content-Type: multipart/alternative; boundary="------------eNwxDJR5A7Dj7ADvEvS4khDA" Message-ID: Date: Sun, 4 May 2025 22:22:05 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird From: Michael StJohns To: Russ Housley References: <07795EC6-BE7E-40D9-A860-B53A268D69CB@vigilsec.com> <9c438de1-bec9-4bb4-b1d0-589163cec00c@nthpermutation.com> <73616952-97F4-47A5-8C2F-55B966CE181F@vigilsec.com> Content-Language: en-US In-Reply-To: X-Antivirus: Norton (VPS 250504-4, 5/4/2025), Outbound message X-Antivirus-Status: Clean Message-ID-Hash: D2Y6JQUBAOW6DYWP5IIQKR7A7Q42W4GX X-Message-ID-Hash: D2Y6JQUBAOW6DYWP5IIQKR7A7Q42W4GX X-MailFrom: msj@nthpermutation.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: spasm@ietf.org X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5Blamps=5D_Re=3A_WGLC_for_draft-ietf-lamps-csr-attestation-18?= List-Id: This is the mail list for the LAMPS Working Group Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This is a multi-part message in MIME format. --------------eNwxDJR5A7Dj7ADvEvS4khDA Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Russ - to close out the ASN1 specific comments  - Referencing X.680, Appendix A, I get this for Hint: (these both compile at the asn1.io playground). -- At least 2 and not more than 10 DNS labels including the TLD. The last label has at least 2 letters. Optional port specification. -- Basically a URI with just the DNS name and an optional port and without everything else. Hint ::= IA5String (PATTERN "(([a-z]|[A-Z])\w#(,63)\.)#(1,9)([a-z]|[A-Z])\w#(1,63)(:\d#(1,5))?") Alternately (just constraining the included characters): Hint ::= IA5String (FROM ("a".."z" | "A".."Z" | "0".."9" | ".:")) Assuming the change to [A]ncillary from [H]int  and not making Hint the default- this results in the following changes to the EVIDENCE-STATEMENT definitions in appendix A: EvidenceStatementSet EVIDENCE-STATEMENT ::= { --- TPM 2.0 { Tcg-attest-tpm-certify IDENTIFIED BY tcg-attest-tpm-certify ANCILLARY TYPE Hint IS preferredPresent }, ..., --- PSA { OCTET STRING IDENTIFIED BY { 1 3 6 1 5 5 7 1 99 } ANCILLARY TYPE Hint IS preferredPresent } } and in Appendix B: tcgDiceCmwEvidenceStatement EVIDENCE-STATEMENT ::= { DiceConceptualMessageWrapper IDENTIFIED BY tcg-dice-conceptual-message-wrapper ANCILLARY TYPE Hint IS preferredPresent } tcgDiceTcbInfoEvidenceStatementES EVIDENCE-STATEMENT ::= { DiceTcbInfo IDENTIFIED BY tcg-dice-TcbInfo ANCILLARY TYPE Hint is preferredPresent } -- or "required" depending... Another nit - 1.3.6.2.5.5.7.1 certificate extensions registry... probably not the right place for EVIDENCE-STATEMENT registrations - even for an example? Later, Mike On 5/4/2025 7:46 PM, StJohns, Michael wrote: > With the exception of the item you note (a default type for the > secondary- “hint” field and its presence indication), that’s correct.  > I used “ancillary” where you have “hint” because the general case is > just additional data specific to the evidence type. > > For reference this uses the object id to identify the type (and > possibly presence) of both the main field and the ancillary. > > Given the text describing the IA5String hint field, I’d define the > Hint type using either the FROM or PATTERN constraint - ideally the > latter.  E.G. > > — where you have MikesHint use this instead > Hint ::= IA5String (FROM > (“0..9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.:”)) > > Or > > Hint ::= IA5String (PATTERN “”) > > Mike > > > > On Sun, May 4, 2025 at 18:10 Russ Housley wrote: > > > Mike: > > I could not get your ASN.1 to compile.  Please look at this.  Does > it do what you are suggesting? > > I realize that I removed the DEFAULT type of the Hint being an > OCTET STRING, but I think the rest is captured. > > If this captures your idea, then the authors can respond about > whether they like it. > > Russ > > = = = = = = = > > FooBarModule > DEFINITIONS IMPLICIT TAGS ::= BEGIN > > EVIDENCE-STATEMENT ::= CLASS { >   &id          OBJECT IDENTIFIER UNIQUE, >   &Type, >   &hintPresent ParamOptions DEFAULT absent, >   &HintType    OPTIONAL > } WITH SYNTAX { >   &Type IDENTIFIED BY &id >   [HINT TYPE &HintType ARE &hintPresent] > } > > EvidenceStatementSet EVIDENCE-STATEMENT ::= { >    mikesEvidenceStatement | otherEvidenceStatement, ... } > > EvidenceStatements ::= SEQUENCE SIZE (1..MAX) OF EvidenceStatement > > EvidenceStatement ::= SEQUENCE { >    type EVIDENCE-STATEMENT.&id({EvidenceStatementSet}), >    stmt EVIDENCE-STATEMENT.&Type({EvidenceStatementSet}{@type}), >    hint > EVIDENCE-STATEMENT.&HintType({EvidenceStatementSet}{@type}) OPTIONAL } > > ParamOptions ::= ENUMERATED { >    required,         -- Parameters MUST be encoded in structure >    preferredPresent, -- Parameters SHOULD be encoded in structure >    preferredAbsent,  -- Parameters SHOULD NOT be encoded in structure >    absent,           -- Parameters MUST NOT be encoded in structure >    inheritable,      -- Parameters are inherited if not present >    optional,         -- Parameters MAY be encoded in the structure >    ... } > > mikesEvidenceStatement EVIDENCE-STATEMENT ::= { >    MikesASN1Structure IDENTIFIED BY id-mikes-statement >    HINT TYPE MikesHint ARE required } > > id-mikes-statement OBJECT IDENTIFIER ::= { 1 1 1 1 1 1 } > > MikesASN1Structure ::= OCTET STRING > > MikesHint ::= IA5String > > otherEvidenceStatement EVIDENCE-STATEMENT ::= { >    OtherStructure IDENTIFIED BY id-other-statement } > > id-other-statement OBJECT IDENTIFIER ::= { 2 2 2 2 2 2 } > > OtherStructure ::= PrintableString > > END > --------------eNwxDJR5A7Dj7ADvEvS4khDA Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Hi Russ - to close out the ASN1 specific comments  -

Referencing X.680, Appendix A, I get this for Hint: (these both compile at the asn1.io playground).

-- At least 2 and not more than 10 DNS labels including the TLD. The last label has at least 2 letters. Optional port specification.
-- Basically a URI with just the DNS name and an optional port and without everything else.
Hint ::= IA5String (PATTERN "(([a-z]|[A-Z])\w#(,63)\.)#(1,9)([a-z]|[A-Z])\w#(1,63)(:\d#(1,5))?")

Alternately (just constraining the included characters):

Hint ::= IA5String (FROM ("a".."z" | "A".."Z" | "0".."9" | ".:"))
Assuming the change to [A]ncillary from [H]int  and not making Hint the default- this results in the following changes to the EVIDENCE-STATEMENT definitions in appendix A:

EvidenceStatementSet EVIDENCE-STATEMENT ::= {
     --- TPM 2.0
     { Tcg-attest-tpm-certify IDENTIFIED BY tcg-attest-tpm-certify 
                              ANCILLARY TYPE Hint IS preferredPresent },
     ...,

     --- PSA
     { OCTET STRING IDENTIFIED BY { 1 3 6 1 5 5 7 1 99 } 
                    ANCILLARY TYPE Hint IS preferredPresent }
   }


and in Appendix B:

tcgDiceCmwEvidenceStatement EVIDENCE-STATEMENT ::= {
                   DiceConceptualMessageWrapper IDENTIFIED BY tcg-dice-conceptual-message-wrapper 
                                                ANCILLARY TYPE Hint IS preferredPresent
                  }


tcgDiceTcbInfoEvidenceStatementES EVIDENCE-STATEMENT ::=  {
                  DiceTcbInfo IDENTIFIED BY tcg-dice-TcbInfo
                              ANCILLARY TYPE Hint is preferredPresent
                 }

-- or "required" depending...

Another nit - 1.3.6.2.5.5.7.1 certificate extensions registry... probably not the right place for EVIDENCE-STATEMENT registrations - even for an example?

Later, Mike

On 5/4/2025 7:46 PM, StJohns, Michael wrote:
With the exception of the item you note (a default type for the secondary- “hint” field and its presence indication), that’s correct.  I used “ancillary” where you have “hint” because the general case is just additional data specific to the evidence type.  

For reference this uses the object id to identify the type (and possibly presence) of both the main field and the ancillary.

Given the text describing the IA5String hint field, I’d define the Hint type using either the FROM or PATTERN constraint - ideally the latter.  E.G.

— where you have MikesHint use this instead
Hint ::= IA5String (FROM (“0..9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.:”))

Or 

Hint ::= IA5String (PATTERN “<tbd>”)

Mike



On Sun, May 4, 2025 at 18:10 Russ Housley <housley@vigilsec.com> wrote:

Mike:

I could not get your ASN.1 to compile.  Please look at this.  Does it do what you are suggesting?

I realize that I removed the DEFAULT type of the Hint being an OCTET STRING, but I think the rest is captured.

If this captures your idea, then the authors can respond about whether they like it.

Russ

= = = = = = =

FooBarModule
DEFINITIONS IMPLICIT TAGS ::= BEGIN

EVIDENCE-STATEMENT ::= CLASS {
  &id          OBJECT IDENTIFIER UNIQUE,
  &Type,
  &hintPresent ParamOptions DEFAULT absent,
  &HintType    OPTIONAL
} WITH SYNTAX {
  &Type IDENTIFIED BY &id
  [HINT TYPE &HintType ARE &hintPresent]
}

EvidenceStatementSet EVIDENCE-STATEMENT ::= {
   mikesEvidenceStatement | otherEvidenceStatement, ... }

EvidenceStatements ::= SEQUENCE SIZE (1..MAX) OF EvidenceStatement

EvidenceStatement ::= SEQUENCE {
   type EVIDENCE-STATEMENT.&id({EvidenceStatementSet}),
   stmt EVIDENCE-STATEMENT.&Type({EvidenceStatementSet}{@type}),
   hint EVIDENCE-STATEMENT.&HintType({EvidenceStatementSet}{@type}) OPTIONAL }

ParamOptions ::= ENUMERATED {
   required,         -- Parameters MUST be encoded in structure
   preferredPresent, -- Parameters SHOULD be encoded in structure
   preferredAbsent,  -- Parameters SHOULD NOT be encoded in structure
   absent,           -- Parameters MUST NOT be encoded in structure
   inheritable,      -- Parameters are inherited if not present
   optional,         -- Parameters MAY be encoded in the structure
   ... }

mikesEvidenceStatement EVIDENCE-STATEMENT ::= {
   MikesASN1Structure IDENTIFIED BY id-mikes-statement
   HINT TYPE MikesHint ARE required }

id-mikes-statement OBJECT IDENTIFIER ::= { 1 1 1 1 1 1 }

MikesASN1Structure ::= OCTET STRING

MikesHint ::= IA5String

otherEvidenceStatement EVIDENCE-STATEMENT ::= {
   OtherStructure IDENTIFIED BY id-other-statement }

id-other-statement OBJECT IDENTIFIER ::= { 2 2 2 2 2 2 }

OtherStructure ::= PrintableString

END


--------------eNwxDJR5A7Dj7ADvEvS4khDA--