IETF Logo Mail Archive

Re: [lamps] is the CSRattr ASN.1 broken or not ... Re: New Version Notification for draft-richardson-lamps-rfc7030-csrattrs-02.txt

Sean Turner <sean@sn3rd.com> Tue, 05 April 2022 19:27 UTC

Return-Path: <sean@sn3rd.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D7B53A11BF for <spasm@ietfa.amsl.com>; Tue, 5 Apr 2022 12:27:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.109
X-Spam-Level:
X-Spam-Status: No, score=-7.109 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FV9Gf382WSqG for <spasm@ietfa.amsl.com>; Tue, 5 Apr 2022 12:27:09 -0700 (PDT)
Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7F913A118E for <spasm@ietf.org>; Tue, 5 Apr 2022 12:26:57 -0700 (PDT)
Received: by mail-qt1-x834.google.com with SMTP id s7so491649qtk.6 for <spasm@ietf.org>; Tue, 05 Apr 2022 12:26:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=NIhYOaYAM+6P+1yLyAiA75UUM7njAV7vFH+ONoQzkYE=; b=BHftOXFmZxE/gIn3lN5qARXWMx6ZBKeJd+LJk7xv9KTWzbXPzAxqbpCSL3OsDN2FbH /BtBqcNGkE53SS2KbD8T7x+hG1N1wiNGjqOWMTyOaZ/FnLlx6yGFVRBRbYsf4pQunU+3 vtpUOJI22tx8g+W35MsfDDKyy5q3Swm03K1bA=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=NIhYOaYAM+6P+1yLyAiA75UUM7njAV7vFH+ONoQzkYE=; b=FSJYjPrtjC2WAySreXtzEgibn3SryrSW2YIxuPAkznS6iXsnggT/DAwIWFnxCsQCCf y8JR2QVSmbVm7rodKQtfbaL0esQRsZB21IwkdbNuHGuvAMvh09Jz5MDccZ+o5bbNR51P eE0pqvLiKwhp0ovHhhuycmkzDWyEHG8f7VTksSXNX0s6vvqKLQn1WJLenfdUdOAba/+x kkyyY/jYLPVocsBhalKXplxHK6OPF1e3ZsZplYmj+pDMDAUqZsnxeWtY+ShZhf+ZlAKQ 5waGU6ow33i1C1mD5kyWtKK1PaE7sIK5jt3BB+m1lMA+gdofeeQjRberw4BIPq6KFY9M /Pvw==
X-Gm-Message-State: AOAM5336UCeffllnOVSfnqpWHXCXwThYOiADdHFWQdTk2xSJeHk7CuLR SHh6mwnuI+jzQ/D3qKAWyAbtLg==
X-Google-Smtp-Source: ABdhPJzD8ChDDQjVPZI7Ia1zlDzf+s0mEZ6htP53jX/7I9q2IO4CmSg+ORX932Y/irE1rZprtyQFAg==
X-Received: by 2002:a05:622a:550:b0:2e2:38d6:c714 with SMTP id m16-20020a05622a055000b002e238d6c714mr4519396qtx.457.1649186816172; Tue, 05 Apr 2022 12:26:56 -0700 (PDT)
Received: from smtpclient.apple (pool-71-178-177-131.washdc.fios.verizon.net. [71.178.177.131]) by smtp.gmail.com with ESMTPSA id w10-20020a05620a424a00b00680c0c0312dsm8634808qko.30.2022.04.05.12.26.55 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 05 Apr 2022 12:26:55 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.120.0.1.13\))
From: Sean Turner <sean@sn3rd.com>
In-Reply-To: <997A2058-20B5-4B95-AFFA-22FB145D798D@vigilsec.com>
Date: Tue, 5 Apr 2022 15:26:53 -0400
Cc: David von Oheimb <David.von.Oheimb@siemens.com>, LAMPS WG <spasm@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <F5F022A8-DF2F-43FB-967B-C6D27BBC959F@sn3rd.com>
References: <164667410940.12091.15394112688281514126@ietfa.amsl.com> <15416.1646681868@localhost> <D095D84D-9633-44BB-AA6F-440B8BC00F68@sn3rd.com> <5cfb6e20b225da072695a4f13088a8065203ca4e.camel@siemens.com> <9649E03B-99A8-420C-8D56-CC0CD0E5F8F8@vigilsec.com> <230008b3fdb35674f01eb37145a9e979d35a74b2.camel@siemens.com> <997A2058-20B5-4B95-AFFA-22FB145D798D@vigilsec.com>
To: Russ Housley <housley@vigilsec.com>
X-Mailer: Apple Mail (2.3654.120.0.1.13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/C5Gsp85Fik5tXDEDIIvHVZ9DFAU>
Subject: Re: [lamps] is the CSRattr ASN.1 broken or not ... Re: New Version Notification for draft-richardson-lamps-rfc7030-csrattrs-02.txt
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Apr 2022 19:27:24 -0000


> On Apr 5, 2022, at 11:57, Russ Housley <housley@vigilsec.com> wrote:
> 
>  If we can list those, we might be able to just document the preferred approach and note the other things that are seen in the wild.
> 
> Russ

I know there are folks that would like to provide the client the entire CSR, minus the public key & signature on the CSR. You can do that by returning a pKCS7PDU attribute with a ContentInfo of PKIData->reqSequence->tcr/crm. If the client and server have some kind of trust relationship, then the server could also sign the PKIData.

spt

v2.8.7 | Report a Bug | By Email