Re: [lamps] is the CSRattr ASN.1 broken or not ... Re: New Version Notification for draft-richardson-lamps-rfc7030-csrattrs-02.txt

[Sean Turner <[e-mail]>]

> On Apr 5, 2022, at 14:40, Russ Housley <[e-mail]> wrote:
> 
> 
> 
>> On Apr 5, 2022, at 2:18 PM, Michael Richardson <[e-mail]> wrote:
>> 
>> David von Oheimb <[e-mail]> wrote:
>>> As I wrote earlier, the way CSRattrs are defined for EST in RFC
>>> 7030 section 4.5.2:
>> 
>>> CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
>> 
>>> AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }
>> 
>>> Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
>>> type ATTRIBUTE.&id({IOSet}),
>>> values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type}) }
>> 
>> Is there another way to express the same concept that would be understandable
>> to more people?
> 
> 
> I do not know whether the OLD ASN.1 syntax is easier to read for some.  This would be:
> 
>    CsrAttrs ::= SEQUENCE SIZE (0..MAX) OF AttrOrOID
> 
>    AttrOrOID ::= CHOICE (oid OBJECT IDENTIFIER, attribute Attribute }
> 
>    Attribute ::= SEQUENCE {
>      type     AttributeType,
>      values    SET SIZE(1..MAX) OF AttributeValue }
> 
>    AttributeType ::= OBJECT IDENTIFIER
> 
>    AttributeValue ::= ANY DEFINED BY AttributeType
> 
> Russ

The problem really comes down to how extensionRequest is encoded. extensionRequest is defined in RFC 2985) as:

   extensionRequest ATTRIBUTE ::= {
           WITH SYNTAX ExtensionRequest
           SINGLE VALUE TRUE
           ID pkcs-9-at-extensionRequest
   }

   ExtensionRequest ::= Extensions

Then Extensions (using old syntax from 5280):

Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension

   Extension  ::=  SEQUENCE  {
        extnID      OBJECT IDENTIFIER,
        critical    BOOLEAN DEFAULT FALSE,
        extnValue   OCTET STRING
                    -- contains the DER encoding of an ASN.1 value
                    -- corresponding to the extension type identified
                    -- by extnID
        }

So, if you’re going to encode that you need a lot more than just an OID, as is in the example:

In the example:

SEQUENCE (4 elem)
… snip
  SEQUENCE (2 elem)
    OBJECT IDENTIFIER 1.2.840.113549.1.9.14 extensionRequest (PKCS #9 via CRMF)
    SET (1 elem)
      OBJECT IDENTIFIER 1.3.6.1.1.1.1.22 (macAddress). <—“values" here
..snip

If macAddress is included as an extension, then it would need to say whether it’s critical or not and we’d need to provide a value. The “values” portion of the SET OF needs to be:
SEQ OF (for Extensions)
  SEQ (for Extension)
   { extrnID=macAddress OID,
    criticality=T/F (CP dependent),
    extnValue=? } 

I just want to double check again that the macAddress attribute is being carried in the certificate as an actual extension and NOT as a naming attribute?

Cheers,
spt