Re: [lamps] draft-ietf-lamps-cmp-updates

["Brockhaus, Hendrik" <[e-mail]>]

Russ

After having another look into the ASN.1 module in RFC4210 it up to the implementer which ITV he/she wants to use. It is specified like this:


> Von: Russ Housley <[e-mail]>
> 
> Hendrik:
> 
> >> Von: Russ Housley <mailto:[e-mail]>
> >>
> >>> On Jul 27, 2020, at 12:22 PM, Brockhaus, Hendrik
> >> <mailto:[e-mail]> wrote:
> >>>
> >>>> Third, id-it-revPassphrase (which is in a comment) is associated
> >>>> with EncryptedKey instead of EncryptedValue.
> >>>
> >>> Finally, I do not fully understand this specification, too.
> >>> My goal is to update OID {id-it 12}  as specified in section
> >>> 5.3.19.9 and the
> >> only lines in the ASN.1 module on this OID is in comments?
> >>
> >> Right, so it is just and updated comment; however, the place were
> >> this is defined needs to be updated too, right?
> >
> > Yes. But the only place I am aware of where this OID is defined is in section
> 5.3.19.9 of RFC4210. I update this section in section 2.6 of the draft.
> > Are there any other place I should update?
> 
> 
> If that is the case, I suspect that all of the id-it- OID values need to appear in
> this new module.
> 
> Looking at RFC 5912, is seem that Jim and Paul defined these constructs for this
> purpose:
> 
> ~~~
>  INFO-TYPE-AND-VALUE ::= TYPE-IDENTIFIER
> 
>  InfoTypeAndValue ::= SEQUENCE {
>      infoType    INFO-TYPE-AND-VALUE.
>                      &id({SupportedInfoSet}),
>      infoValue   INFO-TYPE-AND-VALUE.
>                      &Type({SupportedInfoSet}{@infoType}) } ~~~
> 
> This is probably something that should be carried forward.
> 
> So, for example, that would lead to this in the ASN.1 module:
> 
> ~~~
>     it-caProtEncCert INFO-TYPE-AND-VALUE ::= {
>       CMPCertificate IDENTIFIED BY id-it-caProtEncCert  } ~~~
> 
> You need a statement like this for each of the id-it- OID values.

Thanks for that hint. 
I added this section to the ASN.1 module:

  INFO-TYPE-AND-VALUE ::= TYPE-IDENTIFIER

   InfoTypeAndValue ::= SEQUENCE {
      infoType    INFO-TYPE-AND-VALUE.
                      &id({SupportedInfoSet}),
      infoValue   INFO-TYPE-AND-VALUE.
                      &Type({SupportedInfoSet}{@infoType}) }

   SupportedInfoSet INFO-TYPE-AND-VALUE ::= { ... }

   id-it-revPassphrase    OBJECT IDENTIFIER ::= {id-it 12}
      RevPassphraseValue      ::= EncryptedKey

In the ASN.1 module in RFC 4210 as well as RFC 5912 (page 50) all definitions for specific id-it OIDs are in comments and supposed to be uncommented according to the given environment.
Is it sufficient to only add id-it-revPassphrase, which I changed, to the ASN.1 module of CMP Updates?

Or would you recommend to copy the complete section 9 of RFC5912 to CMP Updates and perform the changes?


Hendrik