Re: [lamps] ASN.1 module for 7030est clarify - was [pkix] [Errata Held for Document Update] RFC7030 (4384)

[Russ Housley <[e-mail]>]

Michael:

There is noting broken with the ASN.1 module in the current I-D.  The proposal just make it "tighter".

Russ


> On Aug 21, 2020, at 1:21 PM, Michael Richardson <[e-mail]> wrote:
> 
> Jim Schaad <[e-mail]> wrote:
>> So as suggested by Russ, I when and looked at it
> 
> oops, it is in the RFC editor queue at this point.
> 
>> I think that the module needs to have some modifications.
> 
>> 1)  If you really mean to have the oid option for AttrOrOid then you should
>> have
> 
>> AttrOrOID ::= CHOICE {
>> oid	OBJECT IDENTIFIER (OidValueSet),
>> attribute Attribute {{AttrSet}} }
> 
>> OidValueSet OBJECT IDENTIFER ::= { ...}
>> AttrSet ATTRIBUTE  ::= {...}
> 
> Your change involves the (OidValueSet).
> We don't know what the ValueSet will be, so I'm not sure I understand what
> the difference would be.   OidValueSet is whatever has been (or will be) defined for CSRs.
> 
>> 2) I would really suggest that if there are some known values, especially if
>> there are not attributes defined already, that these attributes be defined
>> and added to the value and object sets.
> 
> I can see how this would help implementors, telling them what to expect.
> Is that your idea?
> 
>> This becomes interesting since
>> challengePassword is defined with an attribute in PKSC#9 but appears to be
>> used only as a bare OID in this specification.  That is not how would have
>> expected things to work, I would have thought it was a challengePassword
>> with an empty type value.
> 
> Yes, I think that's right.
> Does the WG need to reset on this document?
> Is this AUTH48'able?
> 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
> -= IPv6 IoT consulting =-
> 
>