IETF Logo Mail Archive

Re: [lamps] draft-ietf-lamps-cmp-updates section 3.8 using pkcs-9-at-localKeyId containing a revocation passphrase hint

"Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com> Fri, 08 May 2020 06:29 UTC

Return-Path: <hendrik.brockhaus@siemens.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 980783A07BB for <spasm@ietfa.amsl.com>; Thu, 7 May 2020 23:29:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=siemens.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hqOP-pIS9G8Z for <spasm@ietfa.amsl.com>; Thu, 7 May 2020 23:29:47 -0700 (PDT)
Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2046.outbound.protection.outlook.com [40.107.22.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5B963A07B5 for <spasm@ietf.org>; Thu, 7 May 2020 23:29:45 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iS8jzOnC9eyAlJ9XbT54Lj6AdIDYUCO7ML1nfM7xeOYUIr/yapnxaQNM+4ZWWt+baiB8SnHk5qclH4W4ngaWPuiA/RsoH4XvD3xHgcflp7gaSD8Udut3Nak19KFZPmsQBjhweWvZSuyO2Gmb51xs+4lhrrrqDee7ZxfCxLoBrfO0Ix5AB4zqNPQHVaM2fH8VAUVmtjxmlZIuJA9PxJ+eZ805Xd/CFtMoxsOPF5IHxzMEQtVefnVGSihDxiAHDQ0sXmU+YdPcvyTzXDo0i0eETt6/bouiULyYJZwlLzKDkdWUW9bVPY13EbgQu3QtpJtTQRpDVN+FNfj6/PStx1AtUg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=75o1gt80OZAvmdgtwlfDqfYW7RerTX/ZOFf0wjbH8/U=; b=euXYlF+PrWIS+fgJD/wvcSqx7u1COCbB1cjeHhzFbgzlem9BIonwpxLsfMspxpD9mI0oKcfj69JhH506cDs0SChaxPSMWozwY46NGkb8YUtaNCugD7Inu5WddrmXDszkNKZnHwX8FP43I8QNUIf2Gl2qQFIJMKG7CswDDAyxij1VEF0lvP5V/+o+KnH0apwLaeW9ACfPEIUUB1DeRzdJtam5CwUe9fIJ+n01LxmbgkYIkNGjRW9ExqMSaEsst1vAmsXxWWEqlSUh8evFTktpI/JvnGEerwhyuy2n1s+UY4RLj2myW8229MXPNg8+NaRaT1qR0cSXLMa3m22pRP6m8Q==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.onmicrosoft.com; s=selector1-siemens-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=75o1gt80OZAvmdgtwlfDqfYW7RerTX/ZOFf0wjbH8/U=; b=Nn5Y//aR0QVrfFMhp7cFlYOd8Wnam2pdxyRRtdFpIrccKMI2cN0SuaquCCeUDMcgwyIdIw0282/H/y7AL1jGMTqjFS3DMAPGoB8WkozQSYMY3oN8yHp8gUd9wcC8ui5LvHfk4oysAFHGUYboOZh9d+NoBf6ybSSsE9QHIbhgyV0=
Received: from AM0PR10MB2402.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:e2::32) by AM0PR10MB3650.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:153::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2979.28; Fri, 8 May 2020 06:29:42 +0000
Received: from AM0PR10MB2402.EURPRD10.PROD.OUTLOOK.COM ([fe80::85a4:2ab:a6b9:e1a3]) by AM0PR10MB2402.EURPRD10.PROD.OUTLOOK.COM ([fe80::85a4:2ab:a6b9:e1a3%6]) with mapi id 15.20.2958.034; Fri, 8 May 2020 06:29:42 +0000
From: "Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com>
To: Jim Schaad <ietf@augustcellars.com>, 'LAMPS WG' <spasm@ietf.org>
CC: "steffen.fries@siemens.com" <steffen.fries@siemens.com>
Thread-Topic: [lamps] draft-ietf-lamps-cmp-updates section 3.8 using pkcs-9-at-localKeyId containing a revocation passphrase hint
Thread-Index: AdYjiqD70iVEvJBYSCuMsO7kBTpDbwAPsFkAAE34PwA=
Date: Fri, 08 May 2020 06:29:42 +0000
Message-ID: <AM0PR10MB240224A6A4D073D6E2614C8FFEA20@AM0PR10MB2402.EURPRD10.PROD.OUTLOOK.COM>
References: <AM0PR10MB2402173DFBD40DFF043AE839FEA40@AM0PR10MB2402.EURPRD10.PROD.OUTLOOK.COM> <040401d623c9$64fa1d00$2eee5700$@augustcellars.com>
In-Reply-To: <040401d623c9$64fa1d00$2eee5700$@augustcellars.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-document-confidentiality: NotClassified
authentication-results: augustcellars.com; dkim=none (message not signed) header.d=none;augustcellars.com; dmarc=none action=none header.from=siemens.com;
x-originating-ip: [165.225.200.180]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: c03197f4-7da8-4d85-4533-08d7f31931a1
x-ms-traffictypediagnostic: AM0PR10MB3650:|AM0PR10MB3650:
x-ld-processed: 38ae3bcd-9579-4fd4-adda-b42e1495d55a,ExtAddr
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <AM0PR10MB365097799A8729E2565002B7FEA20@AM0PR10MB3650.EURPRD10.PROD.OUTLOOK.COM>
x-ms-oob-tlc-oobclassifiers: OLM:8273;
x-forefront-prvs: 039735BC4E
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: D0hMGCZtHwlUnM187JeDu77h8qy/4OrqCsCjhMY/oGaBtV12oP/GzsdKbsaAmTheU/NQr8v+z+O4Ep4/ZHg7ZceieULAYu0cvknY9ZlnsDcADlxiN6l2gjuC7KqlXQ9j33AiDU9J2JPQCcV8Wd66G8hizki3lMJD0/gqae8qKqXrC6hGgGW8zTR1z38ETnWspqxHrDD35Bpy7aMOyx5+k1wLX+wCpngDw7ZQgMFjQuUHu1p/Yi0lZzUbZnp3Zj9wggRsEF2vTANG3jaBRsnTB7DPj/8UOPiru27YsB66Ul+TCxvV4uxnxPvuiF7K7e8oUIPpU2pDKEHHdKOXxOI0i7GcP4BUEOndrwxVicTj0XDYIlg0kGsbwTY3XQFlJkcYekng7yZNfv6WcOwCtzcJoXA1beCeZya2bELjtnhrAlSPHRZMGieIAYqRJS2t0F3Y4YVm6VxQtmmfZVPXxDwHAeZxgIVUmUSspz3SjXGWeWAD6wEGfZDtHDNAb3OuaZ6F8iAEhk0cLa+ZY88iHN/60w==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR10MB2402.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(39860400002)(346002)(396003)(366004)(376002)(33430700001)(9686003)(55016002)(316002)(8676002)(6506007)(66556008)(66446008)(52536014)(71200400001)(107886003)(83300400001)(8936002)(19627235002)(4326008)(83320400001)(83280400001)(66946007)(83310400001)(83290400001)(76116006)(110136005)(55236004)(26005)(186003)(7696005)(33440700001)(64756008)(66476007)(33656002)(478600001)(86362001)(15650500001)(5660300002)(2906002); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: fis4W2UAATNu2k95Yycid+a+RlrY1jRSHg+taCRXIK7TU107bPFN8OdfzH5K0ixUsSjmMqJpHQIIw+J2XWn5luI0kdZ4B5S0FblJKi03Lp6KdPiNLZZ2iS1rjWrlPCTi5oBEGu9TLSqtt7AitOvnA9yUpAjybyEefdpQlNM31mD6ONUhx3Vyv6NAPoXkDd6Gg8QtkE6GW4jgvDEQSd8FMtaEyeRwKRXzrG+l+GjV/55uZo1P5XhsTcx5jpmkrNuzO5IaZCMYR0TG+qrgayf8PkPKsXPntF1xXXU64vO+G4r33rsLjXomNkkKqHbeNvA7Y4f50pqzZlmB6k+qckP/qaZ5Is08kREC/Bz4jK2hvpwgTbqZfDEC1Y1iwEk1/7P1r/OucI7We6yTfB19Ejuibbmnl4Oofw7Bl4MHWlC0MPJ036eQKyG8kVGsGRBrMNfhMd3qoBqKUSs/81eDZL866qj5hD93GLFU9s28epRdWkEsyT0TCN5j2AHA2tu2aM7e
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: siemens.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c03197f4-7da8-4d85-4533-08d7f31931a1
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 May 2020 06:29:42.7949 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: tk9HNBVrV4l1hd+MzEWsEBv9sEVqxGGHtJFKf87rjYsOgq2q869k/d0NUMGjMsC976RxDhS+xWXx5IG/HoDjkC8IQD6xYZTQ0b173ASJw4E=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB3650
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/cNcpnYgOc0Y5XSpeX50IgXKWKX8>
Subject: Re: [lamps] draft-ietf-lamps-cmp-updates section 3.8 using pkcs-9-at-localKeyId containing a revocation passphrase hint
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 May 2020 06:29:50 -0000

> Von: Spasm <spasm-bounces@ietf.org> Im Auftrag von Jim Schaad
> Gesendet: Mittwoch, 6. Mai 2020 19:12
>
> I would generally prefer the use of pkcs-9-at-localKeyId due to the fact that it is an OCTET STRING.  
> I don't like the use of BMPString for much of anything.  The only worry that I have is this is not 
> being used according to the description as this is not "locally in applications".  I would interpret this 
> as not leaving the local machine.  

I see the issue. RFC2985  says:
   The localKeyId attribute type specifies an identifier for a
   particular key.  It is only to be used locally in applications.

I updated Appendix B of RFC4210 only for completeness of changing from EncryptedValue to 
EncryptedKey. Therefore I tried to reuse existing OIDs instead of defining new ones. Currently I see the 
best fit with localKeyId for transporting the identifier of the revocation passphrase and I regard the 
extension of the scope as minor. What do others think?

Would the use of localKeyId be acceptable despite the slide expansion of the scope?
Does anyone sees a better solution?
Or should I register an additional OID for this use case?

-- Hendrik

> > From: Brockhaus, Hendrik <mailto:hendrik.brockhaus@siemens.com> 
> > Sent: Wednesday, May 6, 2020 2:43 AM
> >
> > During IETF 107 we discussed whether to use pkcs-9-at-friendlyName or pkcs-9-at-localKeyId as 
> > specified in RFC 2985 section 5.5 in envelopedData to transport an identifier for the revocation 
> > passphrase.
> > The WG seemed to prefer the localKeyId.
> > 
> > @Jim, did you manage to take a look on this and do you have a different opinion?

v2.46.0 | Report a Bug | By Email | System Status