Re: [lamps] CMP Update of CertificationRequest

["Brockhaus, Hendrik" <[e-mail]>]

Russ

> Von: Russ Housley <[e-mail]>
> 
> However, RFC 6402 did choose to locally define CertificationRequest.  I believe
> this was done because there was a place to IMPORT for the newer ASN.1 syntax,
> but not the older.  That way, the two modules are defining exactly the same
> things, even though the newer syntax could IMPORT it from RFC 2986.
> 
> Maybe we should continue to IMPORT from RFC 2986 in the newer ASN.1
> syntax, and define locally in the older ASN.1 syntax, with a comment that this
> structure matches the one defined in RFC 2986.  This definition can be lifted
> from RFC 6402, where Jim Schaad already did that work.

RFC 4210 Appendix F imports CertificationRequest from RFC 2986.

         CertificationRequest
                FROM PKCS-10 {iso(1) member-body(2)
                              us(840) rsadsi(113549)
                              pkcs(1) pkcs-10(10) modules(1) pkcs-10(1)}

         -- (specified in RFC 2986 with 1993 ASN.1 syntax and IMPLICIT
         -- tags).  Alternatively, implementers may directly include
         -- the [PKCS10] syntax in this module

RFC 5912 Section 9 imports CertificationRequest from the updated PKCS#10 module from Section 5. Jim already points the used to possibly directly add the syntax here.

CertificationRequest
 FROM PKCS-10
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkcs10-2009(69)}
 -- (specified in RFC 2986 with 1993 ASN.1 syntax and IMPLICIT
 -- tags).  Alternatively, implementers may directly include
 -- the [PKCS10] syntax in this module

Do you think we should change this and directly add the new syntax from RFC 6402 to modules in CMP Updates?

Hendrik