Re: [lamps] examples in lamps-rfc7030-csrattrs

[Corey Bonnell <[e-mail]>]

Hi Michael,
It appears that the example in the -01 draft has a few issues, mainly
surrounding
implicit/explicit tagging and level of nesting of SET/and SEQUENCE elements.

I took a stab at
generating an Attributes using Russ's pyasn1-alt-modules library. The code
can be found here:
https://gist.github.com/CBonnell/a46f9065f121bcb1b88c02e1204fd4eb

Running the code outputs a hex string, which when converted to binary and
fed to dumpasn1 produces:

  0 104: SET {
  2 102:   SEQUENCE {
  4   9:     OBJECT IDENTIFIER extensionRequest (1 2 840 113549 1 9 14)
 15  89:     SET {
 17  87:       SEQUENCE {
 19  85:         SEQUENCE {
 21   3:           OBJECT IDENTIFIER subjectAltName (2 5 29 17)
 26   1:           BOOLEAN TRUE
 29  75:           OCTET STRING, encapsulates {
 31  73:             SEQUENCE {
 33  71:               [0] {
 35   8:                 OBJECT IDENTIFIER '1 3 6 1 5 5 7 8 10'
 45  59:                 [0] {
 47  57:                   IA5String
       :
'[e-mail]'
       :                   'ample.com'
       :                   }
       :                 }
       :               }
       :             }
       :           }
       :         }
       :       }
       :     }
       :   }

https://lapo.it/asn1js/#MWgwZgYJKoZIhvcNAQkOMVkwVzBVBgNVHREBAf8ESzBJoEcGCCsG
AQUFBwgKoDsWOXJmYzg5OTQrZmQ3MzlmYzIzYzM0NDAxMTIyMzM0NDU1MDAwMDAwMDArQGFjcC5l
eGFtcGxlLmNvbQ

Thanks,
Corey

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Michael Richardson
Sent: Friday, September 30, 2022 12:38 PM
To: David von Oheimb <[e-mail]>; LAMPS WG
<[e-mail]>
Subject: [lamps] examples in lamps-rfc7030-csrattrs


David and I have some back and forth about the examples.
My output, which I've added to -01 which I just posted some from an RFC8995
Registrar.

As I don't have a CSR Attributes model, I'm having to build things with ASN1
primitives, and I am not very knowledgeable about some ASN1 things.
(My thanks to Nico Williams who sorted me out on a fundamental point by chat
on Wednesday)

https://www.ietf.org/archive/id/draft-ietf-lamps-rfc7030-csrattrs-01.html#na
me-rfc8994-acp-subjectaltname-
is my example.  I added to the Makefile:

example01.acp.csrattr.dump: example01.acp.csrattr.der
	dumpasn1 -htl example01.acp.csrattr.der | sed -e's/ *$$//'
>example01.acp.csrattr.dump

but, I don't get the OCTET STRING decoded, while the example that David
added does have it.  It could my ASN.1 is not tagged right.  When I go to:

this decoder seems to be okay with it.
 
https://lapo.it/asn1js/#MGQwYgYJKoZIhvcNAQkOMVUwUwYDVR0RAQH_BEmgRzBFBggrBgEF
BQcICgw5cmZjODk5NCtmZDczOWZjMjNjMzQ0MDExMjIzMzQ0NTUwMDAwMDAwMCtAYWNwLmV4YW1w
bGUuY29t

it seems to be okay.  I have added my example as base64 to the appendix.

I have to go eat supper now, but I'll try to close off this thread.
You'll notice a -01 posted.

I have not removed David's example, but I would like the DER associated with
it.

--
Michael Richardson <[e-mail]>, Sandelman Software Works  -=
IPv6 IoT consulting =-